https://seclists.org/oss-sec/2026/q3/688: CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading

Q: Who can exploit this issue?

A client must be able to upload a file to remote storage and create a Data Source table. Those combined privileges can allow execution of arbitrary Java code.

Q: How can I determine whether my deployment is exposed?

Check whether Apache Impala is running a version from 2.7.0 through 4.5.1 and whether any client has both remote-storage upload capability and permission to create Data Source tables. Systems meeting both conditions are potentially exposed.

Q: What can be done if an upgrade cannot happen immediately?

Restrict the ability to upload files to remote storage and to create Data Source tables so that untrusted or unnecessary clients do not have both capabilities. Upgrade to Apache Impala 4.5.2 when possible.

Published Sep 8, 2026

Updated

Affected Software

1 affected component

Apache Impala>=2.7.0<=4.5.1

Frequently Asked Questions

Who can exploit this issue?

A client must be able to upload a file to remote storage and create a Data Source table. Those combined privileges can allow execution of arbitrary Java code.

How can I determine whether my deployment is exposed?

Check whether Apache Impala is running a version from 2.7.0 through 4.5.1 and whether any client has both remote-storage upload capability and permission to create Data Source tables. Systems meeting both conditions are potentially exposed.

What can be done if an upgrade cannot happen immediately?

Restrict the ability to upload files to remote storage and to create Data Source tables so that untrusted or unnecessary clients do not have both capabilities. Upgrade to Apache Impala 4.5.2 when possible.