As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF
A server-side request forgery (SSRF) vulnerability in Apache Impala 4.4.0 through 4.5.1 allows authenticated users with execute permissions on the ai_generate_text() function to exfiltrate secrets from configured credential providers. The vulnerability requires knowledge of the secret's key and affects systems using Hadoop credential provider paths in core-site.xml.
Why it matters: Organizations running Impala 4.4.x or 4.5.x must audit who has ai_generate_text() permissions and patch to a fixed version to prevent credential exposure through SSRF.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF
CVE-2026-57866 is a server side request forgery (SSRF) vulnerability in Apache Impala versions 4.4.0 through 4.5.1 that allows authenticated users with permission to execute the ai_generate_text() function to exfiltrate secrets from configured credential providers. The vulnerability requires knowledge of the secret key and leverages the Hadoop credential provider path configured in core-site.xml.
Why it matters: Organizations running Apache Impala 4.4.x or 4.5.x should audit which users have ai_generate_text() permissions and prioritize patching to prevent credential theft; the CVSS 8.8 severity reflects the risk of secrets exposure in production environments.
- Source published
- First seen by Cybersecurity Tracker