CVE-2026-55976: Apache Hive SSRF Vulnerability

CVE-2026-55976 Overview

CVE-2026-55976 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Apache Hive's Avro Serializer/Deserializer (SerDe) schema resolution logic. Versions before 4.2.1 permit an authenticated remote attacker with CREATE TABLE privilege to set the avro.schema.url table property to an arbitrary URL. When the table is subsequently queried, HiveServer2 fetches that URL under the Hive process identity. Attackers can reach cloud instance metadata endpoints, internal network services, or local files accessible to the Hive process. Apache addressed the issue in Hive 4.2.1.

Critical Impact
An ordinary authenticated Hive user with DDL rights can force HiveServer2 to issue outbound requests to attacker-chosen URLs, exposing cloud metadata credentials and internal services.

Affected Products

Apache Hive versions prior to 4.2.1
HiveServer2 deployments accepting authenticated user DDL
Apache Hive Metastore instances resolving Avro table schemas

Discovery Timeline

2026-08-25 - CVE-2026-55976 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-55976

Vulnerability Analysis

Apache Hive supports Avro tables whose schema is loaded from a URL specified in the avro.schema.url table property. Before version 4.2.1, Hive did not restrict the URI scheme or destination host used for schema resolution. When a query against an Avro table triggered schema loading, Hive fetched the configured URL directly from the HiveServer2 or Metastore process.

This behavior enables Server-Side Request Forgery. An attacker sets avro.schema.url to http://169.254.169.254/latest/meta-data/ or a file:// path, then runs a SELECT on the table. Hive performs the fetch using its own service identity and network position, which typically has access to internal networks and cloud metadata services.

Root Cause

The root cause is missing scheme and host authorization on the avro.schema.url property. Hive treated the URL as a trusted schema location and delegated resolution to Hadoop's filesystem and URL handlers. There was no allowlist of permitted schemes, no restriction on HTTP hosts, and no separation between schema distribution filesystems and arbitrary network endpoints.

Attack Vector

Exploitation requires network access to HiveServer2 or the Metastore, valid Hive authentication, and the CREATE TABLE privilege. External tables must be enabled, which is the default in most deployments. The attacker creates an Avro-backed table with a malicious avro.schema.url, then queries it. The Hive process fetches the URL and, in some code paths, surfaces retrieved content through error messages or schema inference behavior.

The patch in commit 45049202df35cea382616624de3fe8d252aa2d00 introduces a scheme allowlist and HTTP host controls:

java

HIVE_AVRO_SCHEMA_URL_ALLOWED_SCHEMES("hive.avro.schema.url.allowed.schemes",
    "hdfs,s3,s3a,s3n,abfs,abfss,gs,wasb,wasbs,viewfs,o3fs,ofs",
    "Comma-separated list of URI schemes permitted for avro.schema.url when loading schemas from a remote " +
        "location. HTTP/HTTPS and file:// are never allowed via this setting. A URI with no scheme is " +
        "resolved against the default filesystem."),
HIVE_AVRO_SCHEMA_URL_REMOTE_HTTP_ENABLED("hive.avro.schema.url.remote.http.enabled", false,
    "Whether to allow avro.schema.url values that use http or https. When enabled, the host must also appear " +
        "in hive.avro.schema.url.http.allowed.hosts. Disabled by default to prevent server-side request forgery."),
HIVE_AVRO_SCHEMA_URL_HTTP_ALLOWED_HOSTS("hive.avro.schema.url.http.allowed.hosts", "",
    "Comma-separated list of hosts permitted for avro.schema.url when hive.avro.schema.url.remote.http.enabled " +
        "is true. HTTP/HTTPS schema fetch is rejected when this list is empty."),

Source: Apache Hive commit 45049202

Detection Methods for CVE-2026-55976

Indicators of Compromise

Avro tables whose avro.schema.url uses http, https, file, or ftp schemes rather than a distributed filesystem scheme.
Schema URLs pointing at link-local or cloud metadata addresses such as 169.254.169.254, or at internal RFC1918 hosts.
HiveServer2 or Metastore logs recording outbound fetches of avro.schema.url immediately following CREATE TABLE or ALTER TABLE statements.
Cloud instance metadata service access logs showing requests originating from Hive host identities shortly after Avro DDL activity.

Detection Strategies

Query the Metastore for Avro tables and filter table properties where avro.schema.url scheme is not in the approved distributed filesystem list.
Correlate CREATE TABLE and ALTER TABLE events that set avro.schema.url with subsequent SELECT activity on the same table by the same principal.
Alert on schema-resolution failures in HiveServer2 logs that reference unusual URL targets, since exploitation often produces parse errors.

Monitoring Recommendations

Ingest HiveServer2 and Metastore audit logs into a SIEM and build detections for Avro DDL that references non-filesystem URI schemes.
Monitor VPC flow logs and cloud metadata service access logs for requests from Hive worker identities, especially to 169.254.169.254.
Track privileged Hive DDL activity by user, since exploitation requires only ordinary CREATE TABLE rights.

How to Mitigate CVE-2026-55976

Immediate Actions Required

Upgrade Apache Hive to version 4.2.1 or later on all HiveServer2 and Metastore nodes.
Audit existing Avro tables and revoke or rewrite any table whose avro.schema.url references an unexpected scheme or host.
Restrict CREATE TABLE privileges to trusted roles until the upgrade is complete.
Block outbound access from HiveServer2 and Metastore hosts to cloud metadata endpoints and unrelated internal services via network policy.

Patch Information

The fix is available in Apache Hive 4.2.1 and tracked as HIVE-29671. The patch adds three configuration properties that authorize schema URL schemes and HTTP hosts. By default, http and https schemas are rejected and file:// is never permitted. Review the Apache Hive commit details and the Apache mailing list discussion for full context.

Workarounds

Enforce Instance Metadata Service v2 (IMDSv2) on cloud instances hosting Hive to require session tokens for metadata access.
Apply egress firewall rules that permit HiveServer2 outbound traffic only to storage endpoints required for legitimate workloads.
Restrict CREATE TABLE and ALTER TABLE privileges through Ranger or SQL standard authorization until patching is complete.

bash

# Post-upgrade hive-site.xml settings that harden avro.schema.url
# Reject http/https schema fetches entirely (recommended default)
hive.avro.schema.url.remote.http.enabled=false
# Restrict allowed schemes to trusted distributed filesystems only
hive.avro.schema.url.allowed.schemes=hdfs,s3a,abfss,gs
# If HTTP schema hosting is required, explicitly enumerate hosts
# hive.avro.schema.url.remote.http.enabled=true
# hive.avro.schema.url.http.allowed.hosts=schemas.internal.example.com