CVE-2026-56207: Apache Impala SAML2 Auth Bypass Vulnerability

CVE-2026-56207 Overview

CVE-2026-56207 is an authentication bypass vulnerability in Apache Impala's hs2-http interface. The flaw exists in the final step of the Security Assertion Markup Language 2.0 (SAML2) authentication flow, where the signature of the Bearer token is not verified. An attacker can alter the username field inside the token and impersonate any other user. The issue affects Apache Impala versions >=4.0.0 and is fixed in version 4.5.2. The underlying weakness is classified as Improper Verification of Cryptographic Signature [CWE-347].

Critical Impact
Attackers with network access to the hs2-http endpoint can forge SAML2 Bearer tokens and execute Impala queries under the identity of arbitrary users, including privileged accounts.

Affected Products

Apache Impala >=4.0.0 through versions prior to 4.5.2
Deployments exposing the hs2-http interface with SAML2 authentication enabled
Downstream Hadoop distributions bundling vulnerable Impala releases

Discovery Timeline

2026-09-09 - CVE-2026-56207 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-56207

Vulnerability Analysis

Apache Impala supports SAML2 as an authentication mechanism for its HiveServer2 HTTP (hs2-http) interface. After the initial SAML assertion is processed, Impala issues a Bearer token that clients present on subsequent requests. The vulnerable code path parses the token and extracts the username claim without validating the cryptographic signature. As a result, the server trusts any well-formed token structure regardless of whether it was actually issued by Impala.

This is a textbook Improper Verification of Cryptographic Signature weakness [CWE-347]. Signature validation is the sole control that binds a Bearer token to the issuer. When that control is skipped, the token degrades from a signed credential to plaintext identity data that any client can rewrite.

Root Cause

The root cause is a missing signature verification step in the last stage of the SAML2 authentication handler. The token payload is decoded and the username claim is consumed directly. No call is made to validate the signature against Impala's configured signing key before the identity is accepted for authorization decisions.

Attack Vector

An attacker who can reach the hs2-http endpoint first obtains a valid Bearer token, either by completing a legitimate SAML2 flow with their own account or by capturing a token from network traffic. The attacker then modifies the username field inside the token payload to reference a higher-privileged user. Because the server does not verify the signature, the tampered token is accepted and the attacker executes queries and administrative actions as the impersonated user. Refer to the Apache mailing list advisory and the Openwall oss-security thread for the vendor description.

Detection Methods for CVE-2026-56207

Indicators of Compromise

Impala hs2-http sessions where the authenticated username in application logs does not match the identity of the client certificate or source system.
Query activity from user accounts that have no corresponding SAML2 identity provider (IdP) assertion in upstream authentication logs.
Bearer tokens presented to Impala whose signature fails validation when replayed against the configured IdP.

Detection Strategies

Correlate Impala audit logs with IdP authentication events. Flag sessions where an Impala username has no matching successful assertion within the expected time window.
Inspect captured hs2-http traffic for Bearer tokens and validate the signature offline against the configured public key.
Monitor for anomalous privilege use, such as administrative queries executed by service or analyst accounts that historically do not perform them.

Monitoring Recommendations

Enable and centralize Impala audit logging, including the authenticated principal, source IP, and query text for every hs2-http session.
Ship IdP, reverse proxy, and Impala logs into a SIEM to support cross-source correlation on the username field.
Alert on repeated authentication attempts from the same source IP that resolve to multiple distinct usernames within a short interval.

How to Mitigate CVE-2026-56207

Immediate Actions Required

Upgrade Apache Impala to version 4.5.2 or later on all coordinators and daemons exposing hs2-http.
Restrict network access to the hs2-http interface to trusted client subnets until the upgrade is complete.
Rotate any signing keys and revoke outstanding SAML2 Bearer tokens after patching.
Review Impala audit logs from the earliest deployment of a >=4.0.0 release for suspicious identity mismatches.

Patch Information

The Apache Impala project fixes CVE-2026-56207 in version 4.5.2. Operators running any release from 4.0.0 up to but not including 4.5.2 must upgrade. Details are published in the Apache mailing list advisory.

Workarounds

Disable SAML2 authentication on the hs2-http interface and fall back to Kerberos or LDAP until the patched version is deployed.
Terminate client connections at an authenticating reverse proxy that performs its own SAML2 signature validation before forwarding requests to Impala.
Enforce mutual TLS between clients and the hs2-http endpoint to constrain which hosts can present Bearer tokens.

bash

# Configuration example: disable SAML2 on hs2-http until upgrade to 4.5.2
# Remove or comment out the SAML flags in the Impala daemon startup configuration:
#   --saml2_keystore_path=...
#   --saml2_sp_callback_url=...
#   --saml2_idp_metadata=...
# Then restart the impalad service and require an alternative auth mechanism, e.g. Kerberos:
#   --principal=impala/_HOST@REALM
#   --keytab_file=/etc/security/keytabs/impala.keytab