https://seclists.org/oss-sec/2026/q3/687: CVE-2026-57866: Apache Impala: Sects Exfiltration via SSRF

Q: Who can access the affected secrets?

An attacker must be an authenticated Impala user who has permission to execute the ai_generate_text() function. The attacker must also know the key of the secret they want to retrieve.

Q: Which secrets are potentially exposed?

The exposed secrets are those supplied by credential providers configured through the hadoop.security.credential.provider.path property in core-site.xml. Secrets whose keys are not known to the attacker are not identified as retrievable by the provided information.

Q: How can an organization determine whether it is exposed?

Review whether Apache Impala is running a version from 4.4.0 through 4.5.1, whether core-site.xml configures hadoop.security.credential.provider.path, and which authenticated users can execute ai_generate_text(). Systems lacking any of these conditions are not described as exposed by this issue.

Published Sep 8, 2026

Updated

Affected Software

1 affected component

Apache Impala>=4.4.0<=4.5.1

Frequently Asked Questions

Who can access the affected secrets?

An attacker must be an authenticated Impala user who has permission to execute the ai_generate_text() function. The attacker must also know the key of the secret they want to retrieve.

Which secrets are potentially exposed?

The exposed secrets are those supplied by credential providers configured through the hadoop.security.credential.provider.path property in core-site.xml. Secrets whose keys are not known to the attacker are not identified as retrievable by the provided information.

How can an organization determine whether it is exposed?

Review whether Apache Impala is running a version from 4.4.0 through 4.5.1, whether core-site.xml configures hadoop.security.credential.provider.path, and which authenticated users can execute ai_generate_text(). Systems lacking any of these conditions are not described as exposed by this issue.