https://seclists.org/oss-sec/2026/q3/685: CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side quest Forgery
Affected Software
Frequently Asked Questions
Who can exploit this issue?
An attacker who can create or modify an Impala table and set the avro.schema.url table property can trigger Impala to make requests. The attacker can target internal HTTP endpoints that are reachable by Impala but not directly accessible to them.
What types of resources can be requested?
The vulnerable property accepts HTTP URLs and file:/// URIs. This can cause Impala to issue a GET request to an internal endpoint or access a local file URI.
Can an attacker obtain data from the target response?
Response content may be exposed through parsing error messages. The disclosure described is therefore dependent on how the requested content is handled and reported by Impala.
Are default installations affected?
The issue affects Apache Impala 2.0.0 through 4.5.1 on all platforms when an attacker can specify avro.schema.url on a table. The provided information does not state whether unmodified default access controls allow untrusted users to do this.
What is the remediation?
Upgrade Apache Impala to version 4.5.2, which fixes the issue. If upgrading cannot occur immediately, restrict the ability of untrusted users to create or alter tables with the avro.schema.url property.