As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass
Apache Impala versions 4.1.0 through 4.5.2 contain an authentication bypass in the executor webserver due to improper JWT/OAuth implementation. Bearer token signatures are not validated, allowing attackers to access webserver resources when JWT/OAuth authentication is enabled.
Why it matters: Organizations running affected Impala versions with executor webserver JWT/OAuth configured face unauthorized resource access; patch to 4.5.3 or later or disable JWT/OAuth authentication on executor webservers.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass
CVE-2026-97720 affects Apache Impala versions 4.1.0 through 4.5.2 and involves an authentication bypass in the Impala executor webserver due to improper JWT and OAuth (Open Authorization) token validation. Attackers can access executor webserver resources when the server is configured to accept JWT or OAuth tokens, since the Bearer token signatures are not validated. The vulnerability carries a CVSS 3.1 score of 9.1.
Why it matters: Teams running Apache Impala 4.1.0 through 4.5.2 with JWT or OAuth authentication enabled on executor webservers face unauthorized access to sensitive resources and should patch immediately or disable token-based authentication.
- Source published
- First seen by Cybersecurity Tracker