CVE-2026-54048 Overview
CVE-2026-54048 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Impala versions 2.0.0 through 4.5.1. Attackers can specify tblproperties('avro.schema.url'='http://...') or a file:/// URI on a table to force Impala to issue GET requests. These requests originate from the Impala service and can reach internal endpoints that the attacker cannot directly access. Response contents may be leaked through parsing error messages, enabling information disclosure. The Apache Impala project has released version 4.5.2 to remediate the issue. The vulnerability is tracked as CWE-918: Server-Side Request Forgery.
Critical Impact
An authenticated user with the ability to create or alter Impala tables can pivot through the Impala service to enumerate internal HTTP endpoints and read local files reachable via file:/// URIs.
Affected Products
- Apache Impala 2.0.0 through 4.5.1
- All platforms running the affected Impala versions
- Deployments where users can set table properties via SQL
Discovery Timeline
- 2026-09-09 - CVE-2026-54048 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-54048
Vulnerability Analysis
Apache Impala supports Avro-backed tables and allows users to reference an external Avro schema through the avro.schema.url table property. When Impala loads or queries such a table, it fetches the schema from the URL supplied by the user. The fetch operation is performed by the Impala service account, which typically runs with broader network reach than an untrusted end user.
Because Impala does not restrict the URL scheme or destination host, an attacker can point avro.schema.url at arbitrary HTTP endpoints or local files. Any response Impala receives is parsed as an Avro schema. When parsing fails, portions of the response are surfaced in the resulting SQL error message returned to the requester.
This behavior converts Impala into a proxy for probing internal HTTP services, cloud metadata endpoints such as 169.254.169.254, and local files accessible via file:///. The vulnerability is classified under CWE-918.
Root Cause
The root cause is missing validation of the avro.schema.url table property. Impala accepts any URI, dereferences it server-side, and reflects parsing errors containing response data to the caller.
Attack Vector
An attacker with the ability to execute CREATE TABLE or ALTER TABLE ... SET TBLPROPERTIES submits a table definition specifying avro.schema.url pointing to an internal HTTP endpoint or file:/// path. Querying or describing the table triggers Impala to fetch the resource and return response fragments in error output. See the Apache Mailing List Thread and the OpenWall OSS Security Update for the vendor disclosure.
Detection Methods for CVE-2026-54048
Indicators of Compromise
- SQL statements containing avro.schema.url with values pointing to internal IP ranges, localhost, 127.0.0.1, 169.254.169.254, or file:/// URIs
- Outbound HTTP requests originating from Impala daemon hosts to unexpected internal addresses
- Impala query error messages containing fragments of HTML, JSON, or file contents inconsistent with Avro schemas
Detection Strategies
- Audit Impala query logs for CREATE TABLE and ALTER TABLE statements referencing avro.schema.url and inspect the supplied URI
- Monitor Impala daemon network flows for HTTP GET requests to non-approved destinations
- Alert on repeated Avro schema parse failures tied to a single user or session
Monitoring Recommendations
- Forward Impala audit logs and daemon access logs to a centralized analytics platform for correlation
- Baseline expected outbound destinations from Impala hosts and flag deviations
- Track user-submitted table property changes and review anomalous URI schemes
How to Mitigate CVE-2026-54048
Immediate Actions Required
- Upgrade Apache Impala to version 4.5.2 on all cluster nodes
- Restrict CREATE TABLE and ALTER TABLE privileges to trusted principals via Apache Ranger or Apache Sentry authorization policies
- Review existing tables for suspicious avro.schema.url values and remove or rewrite them
Patch Information
Upgrade to Apache Impala 4.5.2, which addresses the SSRF condition. Refer to the Apache Mailing List Thread for the official advisory and release notes.
Workarounds
- Block outbound HTTP traffic from Impala daemon hosts to internal management endpoints and cloud metadata services using host firewall rules
- Deny use of the file:// scheme at the network or proxy layer for Impala service accounts
- Revoke schema-modification privileges from untrusted roles until the upgrade is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
