← Advisories

Apache Impala 4.5.1 Insufficient Authorization Remote Code Execution

High
Advisory ID
ZSL-2026-6003
Release Date
11 September 2026
Vendor
The Apache Software Foundation - https://www.apache.org
Affected Version
4.5.1
Tested On
Windows 10, OpenJDK/21.0.6
Summary

Apache Impala is a modern, open source, distributed SQL query engine for open data and table formats.

Description

Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the driver.url and driver.class properties are not authorization-checked. An authenticated user who can create such a table can therefore point it at an attacker-controlled location and have code loaded and run on the Impala daemon hosts. The related CREATE DATA SOURCE path in CreateDataSrcStmt.java also carries a literal "// TODO: authorization check" where the privilege check belongs.

Proof of Concept
Disclosure Timeline
13.08.2026Vulnerability discovered.
18.08.2026Contact with the vendor.
19.08.2026Vendor forwards details to appropriate PMC.
08.09.2026Vendor responds: Issue reported June 10, 2026.
08.09.2026Replied to the vendor.
08.09.2026Vendor releases version 4.5.2 to address this issue.
11.09.2026Coordinated public security advisory released.
Credits
Vulnerability discovered by zhaokaifei (China Telecom), later by Gjoko Krstic
References
Changelog
11.09.2026Initial release