Apache Impala is a modern, open source, distributed SQL query engine for open data and table formats.
Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the driver.url and driver.class properties are not authorization-checked. An authenticated user who can create such a table can therefore point it at an attacker-controlled location and have code loaded and run on the Impala daemon hosts. The related CREATE DATA SOURCE path in CreateDataSrcStmt.java also carries a literal "// TODO: authorization check" where the privilege check belongs.