CVE-2025-62728: Apache Hive Metastore SQLI Vulnerability

CVE-2025-62728 Overview

CVE-2025-62728 is a SQL injection vulnerability in the Apache Hive Metastore Server (HMS). The flaw exists in the handling of delete column statistics requests issued through the Thrift APIs. An authenticated caller with direct Thrift API access can inject SQL fragments that reach the underlying metastore database.

The issue affects Apache Hive versions from 4.1.0 before 4.2.0. Exploitation requires the caller to have authorization to invoke Thrift APIs directly, which limits exposure in typical deployments where only components like HiveServer2 communicate with HMS. The vulnerable path is also unreachable when metastore.try.direct.sql is set to false.

Critical Impact
Authenticated users with direct Thrift API access can execute arbitrary SQL against the Hive Metastore backend, exposing metadata confidentiality and integrity.

Affected Products

Apache Hive 4.1.0
Apache Hive versions prior to 4.2.0 (starting from 4.1.0)
Apache Hive Metastore Server (HMS) component

Discovery Timeline

2025-11-26 - CVE-2025-62728 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62728

Vulnerability Analysis

The vulnerability resides in the Hive Metastore Server code path that processes delete column statistics requests received over Thrift. Input from the request is concatenated into a SQL statement that is executed directly against the metastore backend database. This classifies as a SQL Injection weakness [CWE-89].

Because HMS stores schema, partition, table, and column-level metadata for Hive and other engines that federate through it, injected SQL can read, modify, or delete metastore records. This can corrupt catalog state or expose sensitive metadata about datasets and users.

Exploitation is bounded by two conditions. First, the attacker must be an authenticated Thrift client, since HMS typically restricts direct API access to trusted services. Second, the vulnerable code path is only reached when the metastore.try.direct.sql property is enabled, which is the default in many deployments.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The delete column statistics handler constructs SQL dynamically from Thrift request parameters without parameterization or sufficient sanitization, allowing attacker-controlled values to alter query structure.

Attack Vector

The attack vector is network-based against the HMS Thrift endpoint. An authorized principal issues a crafted delete column statistics Thrift call in which parameters that flow into the direct SQL path carry injected SQL syntax. The metastore then executes the resulting statement against its backing relational database, such as MySQL, PostgreSQL, or MariaDB.

No verified public exploit code has been observed. Refer to the Apache mailing list advisory and the Openwall OSS-Security post for vendor detail.

Detection Methods for CVE-2025-62728

Indicators of Compromise

Unexpected delete column statistics Thrift requests originating from clients other than HiveServer2 or approved query engines.
Metastore database audit logs showing malformed or unusually structured SQL statements associated with column statistics operations.
Unexplained changes or deletions in TAB_COL_STATS, PART_COL_STATS, or related metastore tables.

Detection Strategies

Enable metastore database query auditing and alert on SQL patterns containing UNION, comment sequences, or stacked statements in stats-related queries.
Monitor HMS Thrift access logs for authentication principals or source IPs that are not part of the approved client inventory.
Correlate Hive Metastore process logs with backend database logs to identify anomalous statement lengths or execution errors on stats endpoints.

Monitoring Recommendations

Baseline the set of clients allowed to reach the HMS Thrift port and alert on new principals or hosts.
Track configuration drift on metastore.try.direct.sql and other metastore properties across the cluster.
Forward HMS and backend database logs to a centralized analytics platform for retention and correlation.

How to Mitigate CVE-2025-62728

Immediate Actions Required

Upgrade Apache Hive to version 4.2.0 or later, which contains the fix.
Restrict network access to the HMS Thrift port so that only trusted services such as HiveServer2 can connect.
Review authentication and authorization on HMS and remove any unnecessary principals with direct Thrift access.

Patch Information

Apache has released Apache Hive 4.2.0, which remediates the SQL injection in the delete column statistics handler. Consult the Apache Hive security advisory for full upgrade guidance and verification steps.

Workarounds

Set metastore.try.direct.sql to false in hive-site.xml to make the vulnerable code path unreachable, accepting the associated performance trade-off.
Place HMS behind network segmentation and firewall rules that limit inbound Thrift connections to a documented allowlist.
Rotate credentials and audit access if HMS Thrift APIs were previously exposed to untrusted networks.

bash

# Configuration example: disable direct SQL in hive-site.xml
# <property>
#   <name>metastore.try.direct.sql</name>
#   <value>false</value>
# </property>

# Verify the effective setting from the Hive CLI
hive --service metatool -listFSRoot
grep -A1 'metastore.try.direct.sql' /etc/hive/conf/hive-site.xml