As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token
Apache Impala versions 4.0.0 through 4.5.1 contain a critical authentication bypass in SAML2 authentication for the hs2-http interface due to missing bearer token signature verification. An attacker can forge tokens to alter usernames and impersonate other users. The vulnerability is resolved in Apache Impala 4.5.2.
Why it matters: Organizations running Impala 4.0.0 through 4.5.1 with SAML authentication face immediate risk of account impersonation and unauthorized data access; patch or upgrade to 4.5.2 now.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token
CVE-2026-56207 is a critical vulnerability in Apache Impala versions 4.0.0 through 4.5.1 that allows attackers to forge SAML2 bearer tokens and bypass authentication on the hs2-http interface. The signature verification step is missing, permitting an attacker to impersonate other users. Apache has released version 4.5.2 to fix the issue.
Why it matters: Organizations running Apache Impala should prioritize upgrading to 4.5.2 immediately, as the vulnerability carries a CVSS score of 9.8 and allows complete authentication bypass leading to unauthorized data access and lateral movement.
- Source published
- First seen by Cybersecurity Tracker