CVE-2026-49845: Apache Hive SQL Injection Vulnerability

CVE-2026-49845 Overview

CVE-2026-49845 is a SQL injection vulnerability in the Apache Hive Metastore direct-SQL partition-name resolution logic. The flaw affects Apache Hive versions before 4.2.1 when metastore.try.direct.sql is enabled, which is the default configuration. Authenticated users with access to Hive Metastore APIs can craft partition names containing single quotes and SQL fragments to alter generated WHERE clauses. Successful exploitation lets attackers read, modify, truncate, or drop unintended partition metadata within tables they can reference. Apache assigned this issue [CWE-94] and recommends upgrading to version 4.2.1.

Critical Impact
Authenticated callers can manipulate Hive Metastore partition operations, including statistics updates, truncation targets, and file-metadata cache operations, by injecting SQL through crafted PART_NAME values.

Affected Products

Apache Hive 4.2.0 and earlier releases
Apache Hive deployments with metastore.try.direct.sql=true (default)
Hive Metastore RPC endpoints exposed to authenticated or network-trusted callers

Discovery Timeline

2026-08-25 - CVE-2026-49845 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-49845

Vulnerability Analysis

The vulnerability resides in how the Hive Metastore resolves partitions by full partition name through direct-SQL helper methods. Several Metastore RPCs pass client-supplied partition names into SQL statements using string concatenation rather than parameterized queries. The DirectSqlUpdatePart.quoteString() helper wraps input in single quotes without escaping embedded quote characters. A partition name containing a single quote can therefore terminate the string literal and inject arbitrary SQL into the surrounding WHERE clause. Affected code paths include partition read operations, statistics updates, truncate operations, metadata cache invalidation, and drop operations. The impact is scoped to partition targeting within tables the attacker can reference, not arbitrary cross-database access.

Root Cause

The root cause is unsafe SQL string construction in the direct-SQL partition resolution paths. Client-controlled PART_NAME values flow into SQL through concatenation instead of JDBC bind parameters. This falls under Improper Control of Generation of Code [CWE-94] as expressed through classic SQL injection semantics.

Attack Vector

An authenticated caller with permission to invoke Hive Metastore partition-name APIs against a target table can send crafted RPC requests. The malicious partition name breaks out of the intended literal, expanding the match set for the query. Downstream operations then act on additional partition rows the attacker did not legitimately reference.

java

 import static org.apache.hadoop.hive.metastore.directsql.MetastoreDirectSqlUtils.extractSqlInt;
 import static org.apache.hadoop.hive.metastore.directsql.MetastoreDirectSqlUtils.extractSqlLong;
 import static org.apache.hadoop.hive.metastore.directsql.MetastoreDirectSqlUtils.getModelIdentity;
+import static org.apache.hadoop.hive.metastore.directsql.MetastoreDirectSqlUtils.makeParams;
 import static org.apache.hadoop.hive.metastore.utils.MetaStoreServerUtils.getPartValsFromName;

The patch introduces makeParams to enable bind-parameter usage in DirectSqlUpdatePart.java. A second fix in MetaStoreDirectSql.java corrects a batching bug where the full partNames list was passed instead of the current batch input, ensuring only the intended partition names are resolved per batch. Source: Apache Hive commit ca64f08.

Detection Methods for CVE-2026-49845

Indicators of Compromise

Partition names in Metastore audit logs or the PARTITIONS.PART_NAME column containing single quotes, comment sequences (--, /*), or SQL keywords such as OR, UNION, SELECT.
Unexpected partition truncation, drop, or statistics recomputation events affecting partitions the invoking user did not directly reference.
Metastore RPC calls (get_partitions_by_names, alter_partition, truncate_table) originating from accounts with anomalous partition-name payloads.

Detection Strategies

Enable Hive Metastore audit logging and parse PART_NAME arguments for characters and tokens that are not valid in Hive partition naming.
Correlate Metastore RPC traffic with backend RDBMS query logs to detect malformed or oversized WHERE clauses on PARTITIONS and PART_COL_STATS tables.
Alert on partition operations that modify more rows than the request implied, particularly for truncate and drop paths.

Monitoring Recommendations

Baseline the Metastore RPC call volume per user and flag deviations tied to partition-name APIs.
Instrument the Metastore JVM with query interceptors to capture direct-SQL statements for offline review.
Forward Hive Metastore and backing database logs to a centralized analytics platform for retrospective hunting.

How to Mitigate CVE-2026-49845

Immediate Actions Required

Upgrade Apache Hive to version 4.2.1, which replaces string concatenation with bind parameters in the affected direct-SQL paths.
Restrict network access to the Hive Metastore Thrift endpoint to trusted service accounts and hosts only.
Review Metastore user permissions and revoke partition-modifying capabilities from accounts that do not require them.

Patch Information

The fix is tracked in HIVE-29622 and delivered through Apache Hive commit ca64f08a8e43db9845b47d5fa2e96f7fdea7288e. Coordination details are available in the Apache mailing list discussion. Upgrade all Hive Metastore server binaries; client-side updates alone are insufficient.

Workarounds

Disable direct SQL by setting metastore.try.direct.sql=false, accepting the performance regression this introduces on partition lookups.
Enforce strict Kerberos authentication and SASL on the Metastore Thrift service to eliminate unauthenticated network callers.
Add an application-layer filter that rejects partition names containing single quotes or SQL metacharacters before they reach the Metastore.

bash

# Disable direct SQL in hive-site.xml as a temporary mitigation
<property>
  <name>metastore.try.direct.sql</name>
  <value>false</value>
</property>
<property>
  <name>hive.metastore.try.direct.sql</name>
  <value>false</value>
</property>