CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths
Path traversal of 'trustedjarpaths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trustedjarpaths'.
The startup flag 'trustedjarpaths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trustedjarpaths' have a non-empty value configured by the Impala admin.
Users are recommended to upgrade to version 4.5.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Impalato a version that resolves this vulnerability.Fixed in 4.5.3
Event History
Frequently Asked Questions
Is a default Impala deployment affected?
The issue requires the Impala administrator to configure a non-empty trusted_jar_paths value. If no trusted path is configured, this path-traversal technique cannot be used.
What access does an attacker need to exploit this issue?
The CVSS vector indicates low-privileged access is required and no user interaction is needed. The attacker also needs an attacker-controlled JAR uploaded elsewhere in a filesystem accessible through Impala DDLs, such as CREATE DATA SOURCE or CREATE TABLE.
What is the practical impact of successful exploitation?
A relative path whose prefix matches a configured trusted path can cause Impala to load an attacker-controlled JAR from a different location in the same filesystem. The traversal cannot override the URI schema.
What should administrators do if they cannot upgrade immediately?
Review trusted_jar_paths and avoid configuring it with a non-empty value unless it is required. Also restrict which users can upload JARs or create objects through Impala DDLs that could place attacker-controlled files on reachable filesystems.
Which version fixes the issue?
Upgrade to Apache Impala 4.5.3, which fixes the vulnerability. The affected version identified in the advisory is 4.5.2.