https://seclists.org/oss-sec/2026/q3/686: CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bear token

Q: Which deployments are exposed to this issue?

Apache Impala versions 4.0.0 through 4.5.1 are affected when using the hs2-http interface with SAML2 authentication. The issue is not described as affecting other interfaces or authentication configurations.

Q: What does an attacker need to do to exploit the vulnerability?

An attacker needs to forge or alter a Bearer token during the final step of SAML2 authentication. Because the token signature is not verified at that step, the attacker can alter the user name and act as another user.

Q: What is the recommended remediation?

Upgrade Apache Impala to version 4.5.2, which fixes the issue.

Published Sep 8, 2026

Updated

Affected Software

1 affected component

Apache Impala>=4.0.0<=4.5.1

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Impala versions 4.0.0 through 4.5.1 are affected when using the hs2-http interface with SAML2 authentication. The issue is not described as affecting other interfaces or authentication configurations.

What does an attacker need to do to exploit the vulnerability?

An attacker needs to forge or alter a Bearer token during the final step of SAML2 authentication. Because the token signature is not verified at that step, the attacker can alter the user name and act as another user.

What is the recommended remediation?

Upgrade Apache Impala to version 4.5.2, which fixes the issue.