CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 9576

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths

CVE-2026-90466 affects Apache Impala 4.5.2 and earlier, where a path traversal vulnerability in the 'trusted_jar_paths' startup flag allows an attacker to load a malicious JAR file by using a relative path that matches a trusted path prefix. Impala 4.5.3 addresses this issue.

Why it matters: Organizations running Apache Impala 4.5.2 or earlier should upgrade immediately to block attackers from executing arbitrary Java code through manipulated JAR loading.

CVEsCVE-2026-90466
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary