Vulnerability/
https://seclists.org/oss-sec/2026/q4/79

https://seclists.org/oss-sec/2026/q4/79: CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths

Q: Are default Impala deployments affected?

The issue requires the Impala administrator to configure a non-empty trusted_jar_paths value. If no trusted path is configured, this path-traversal attack cannot be used.

Q: What does an attacker need to exploit this issue?

An attacker needs a trusted_jar_paths entry whose prefix can be matched by a relative path, and an attacker-controlled JAR uploaded elsewhere in the referenced filesystem through Impala DDLs such as CREATE DATA SOURCE or CREATE TABLE. The traversal cannot override the schema.

Q: What is the recommended remediation?

Upgrade Apache Impala from 4.5.2 to 4.5.3. Version 4.5.3 fixes the issue.

Published Oct 6, 2026

Updated

Affected Software

1 affected component

Apache Impala>=4.5.2<4.5.3

Frequently Asked Questions

Are default Impala deployments affected?

The issue requires the Impala administrator to configure a non-empty trusted_jar_paths value. If no trusted path is configured, this path-traversal attack cannot be used.

What does an attacker need to exploit this issue?

An attacker needs a trusted_jar_paths entry whose prefix can be matched by a relative path, and an attacker-controlled JAR uploaded elsewhere in the referenced filesystem through Impala DDLs such as CREATE DATA SOURCE or CREATE TABLE. The traversal cannot override the schema.

What is the recommended remediation?

Upgrade Apache Impala from 4.5.2 to 4.5.3. Version 4.5.3 fixes the issue.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.