CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Impalato a version that resolves this vulnerability.Fixed in 4.5.3 - Configuration
Disable JWT/OAuth authentication for Impala executors.
Impala executors JWT/OAuth authentication = disabled
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Impala versions through 4.5.2 are affected when an Impala executor webserver is configured to accept JWT/OAuth tokens. The issue concerns resources served by executor webservers.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without privileges or user interaction by presenting a valid JWT. The executor webserver does not validate the bearer token's signature, so it accepts such tokens.
Is JWT/OAuth authentication enabled by default?
The available information does not state whether JWT/OAuth authentication is enabled by default. Exposure depends on the executor webserver being configured to accept JWT/OAuth tokens.
What should be done if an upgrade cannot be applied immediately?
Disable JWT/OAuth authentication for Impala executors until an upgrade can be performed. Upgrading to Apache Impala 4.5.3 fixes the issue.