CVE-2026-57866: Apache Impala SSRF Vulnerability

CVE-2026-57866 Overview

CVE-2026-57866 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Apache Impala versions 4.4.x and 4.5.x. Authenticated users with permission to execute the ai_generate_text() function can abuse the function to exfiltrate secrets managed by the Hadoop credential provider framework. The affected code path reads secrets referenced in the hadoop.security.credential.provider.path property of core-site.xml. Successful exploitation requires the attacker to know the target secret key name.

Critical Impact
Authenticated Impala users can exfiltrate credential provider secrets, exposing keys used to authenticate to downstream systems and cloud services.

Affected Products

Apache Impala 4.4.x
Apache Impala 4.5.x
Deployments using hadoop.security.credential.provider.path in core-site.xml

Discovery Timeline

2026-09-09 - CVE-2026-57866 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-57866

Vulnerability Analysis

Apache Impala exposes the ai_generate_text() user-defined function to allow SQL queries to invoke external AI text-generation providers. The function accepts configuration parameters that resolve secrets through the Hadoop credential provider chain. In vulnerable releases, an authenticated Impala user with permission to execute ai_generate_text() can request the function to read any secret configured through hadoop.security.credential.provider.path.

The function returns or transmits the resolved secret material as part of the outbound request, enabling exfiltration to an attacker-controlled endpoint. This transforms a normal AI integration feature into an SSRF and secret-disclosure primitive. Any credential stored in the provider path becomes reachable to database users who should not have access to it.

Root Cause

The root cause is missing authorization between the calling SQL principal and the secret material resolved by the credential provider. The ai_generate_text() function inherits the daemon-level ability to read credential entries and does not restrict which keys a caller may reference. Combined with the ability to direct outbound HTTP requests to an attacker-chosen destination, this yields both SSRF and secret disclosure.

Attack Vector

The attacker must authenticate to Impala and hold execute privileges on ai_generate_text(). The attacker must also know or guess the name of a secret key stored under the configured credential provider path. The attacker crafts a SQL query invoking ai_generate_text() with parameters that reference the target secret and direct the outbound request to a controlled endpoint. Impala resolves the secret and includes it in the request, delivering the value to the attacker. See the Apache Mailing List Thread and the Openwall OSS-Security Update for vendor details.

Detection Methods for CVE-2026-57866

Indicators of Compromise

Impala query logs containing calls to ai_generate_text() from users or roles that do not normally invoke AI functions.
Outbound HTTP or HTTPS connections from Impala daemons to previously unseen or non-approved external hosts.
Query parameters to ai_generate_text() that reference keys defined under hadoop.security.credential.provider.path.

Detection Strategies

Audit the Impala query history for all invocations of ai_generate_text() and correlate with the executing principal and destination endpoint.
Baseline the expected set of endpoints receiving outbound requests from Impala daemons and alert on deviations.
Enumerate which roles and users hold execute privileges on ai_generate_text() and flag any grants outside a documented allowlist.

Monitoring Recommendations

Forward Impala audit logs and daemon egress network telemetry into a central analytics platform for correlation.
Alert on any DNS resolution or TCP connection from Impala hosts to non-corporate destinations.
Monitor changes to core-site.xml and to the credential provider store for unexpected additions or reads.

How to Mitigate CVE-2026-57866

Immediate Actions Required

Revoke execute privileges on ai_generate_text() from any role that does not have a documented business need.
Rotate all secrets currently stored under the path referenced by hadoop.security.credential.provider.path.
Restrict outbound network access from Impala daemons to an allowlist of approved AI provider endpoints.

Patch Information

Apache has published details through the Apache Mailing List Thread and the Openwall OSS-Security Update. Upgrade Apache Impala to a fixed release beyond the 4.4.x and 4.5.x branches as identified in the vendor advisory. Verify the running version on every Impala coordinator and executor node after the upgrade.

Workarounds

Remove or empty the hadoop.security.credential.provider.path property in core-site.xml for Impala hosts if credential provider integration is not required.
Disable the ai_generate_text() function at the catalog level until the upgrade is complete.
Enforce egress firewall rules that block Impala daemons from reaching arbitrary external hosts.

bash

# Configuration example: revoke privileges and constrain egress
# 1. Revoke execute on the vulnerable function
REVOKE EXECUTE ON FUNCTION ai_generate_text FROM ROLE analyst_role;

# 2. Verify current grantees
SHOW GRANT ON FUNCTION ai_generate_text;

# 3. Restrict Impala daemon egress at the host firewall
iptables -A OUTPUT -m owner --uid-owner impala -p tcp \
  -d approved.ai-provider.example.com --dport 443 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner impala -j REJECT