As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans
A stored cross-site scripting (XSS) vulnerability in Apache Impala versions 2.7.0 through 4.5.2 allows a user with only SELECT permission to inject JavaScript into table aliases, which executes in another user's browser when that user views the query plan in the Web UI. The issue is tracked as CVE-2026-93684 with moderate severity. Apache recommends upgrading to version 4.5.3 to remediate the flaw.
Why it matters: Impala administrators and users should upgrade to 4.5.3 immediately, as any SELECT-privileged user can compromise other users' sessions and steal credentials or perform actions on their behalf.
- Source published
- First seen by Cybersecurity Tracker