CVE-2026-65181

High

Description

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

SeverityHigh

CVSS8.1

Exploit probability—

Product

Apache Impala

PublishedSep 9, 2026

First seenSep 9, 2026

Weakness typeCWE-913CWE-913

How to fix

Update

apache impala4.5.2 or later

Vendor advisories

lists.apache.org/thread/2ty3srsh96j86xxg4g1hbo5rwvszwcnl

Affected products

Product	Affected versions	Fixed in
apache impala	2.7.0 ≤ v < 4.5.2	4.5.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.