CVE-2026-65181 Overview
CVE-2026-65181 is an authorization flaw in Apache Impala versions 2.7 through 4.5. Impala's Data Source table feature fails to enforce sufficient authorization on client-supplied Java class references. A client that holds privileges to upload files to remote storage and create tables can load attacker-controlled Java code and execute it inside the Impala process. The weakness is categorized under [CWE-913: Improper Control of Dynamically-Managed Code Resources]. Apache recommends upgrading to Impala 4.5.2, which contains the fix.
Critical Impact
An authenticated client can achieve arbitrary Java code execution on Impala nodes by abusing Data Source table creation to load a malicious JAR from remote storage.
Affected Products
- Apache Impala 2.7 through 4.5
- Deployments where clients can write to remote storage referenced by Impala
- Fixed in Apache Impala 4.5.2
Discovery Timeline
- 2026-09-09 - CVE-2026-65181 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-65181
Vulnerability Analysis
Apache Impala supports Data Source tables, which allow SQL queries to be answered by external Java-based data source implementations. Creating such a table requires supplying a Java class name and a JAR location that Impala loads at query time. The affected versions do not properly restrict which classes and JARs an authenticated client can register through this interface. An attacker with the ability to upload a JAR to remote storage and create a Data Source table can point Impala at attacker-controlled bytecode. Impala then loads and executes that code inside the query engine, giving the attacker code execution in the Impala service context.
Root Cause
The root cause is insufficient authorization on the Data Source table creation path. Impala trusts the client-supplied class reference and JAR location and does not enforce a privilege model that restricts dynamic code loading to trusted operators. This aligns with [CWE-913], where a dynamically-managed code resource is exposed to untrusted control.
Attack Vector
Exploitation is network-based and requires authenticated privileges. The attacker must be able to upload a JAR file to a storage backend readable by Impala, such as HDFS or an S3-compatible bucket used by the cluster. The attacker then issues a CREATE DATA SOURCE statement referencing the malicious JAR and class, followed by a query that instantiates the class. Impala loads the JAR into its JVM and executes the attacker's code with the privileges of the Impala service account.
No verified public exploit code is available. See the Apache Security Discussion and Openwall OSS-Security Update for the vendor advisory details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-65181
Indicators of Compromise
- Unexpected CREATE DATA SOURCE or CREATE TABLE ... PRODUCED BY DATA SOURCE statements in Impala audit logs.
- JAR files uploaded to HDFS, S3, or other Impala-readable storage from unusual accounts or paths.
- Impalad JVM processes spawning child processes such as sh, bash, python, or curl.
- Outbound network connections initiated by the Impala service to unfamiliar external hosts.
Detection Strategies
- Enable Impala audit logging and alert on any Data Source table creation events, particularly those referencing JAR paths outside an approved allowlist.
- Monitor object storage and HDFS write events for .jar uploads by non-administrative principals.
- Correlate query submissions with process and network telemetry from Impala hosts to catch code execution following Data Source usage.
Monitoring Recommendations
- Baseline the set of Data Source classes and JAR locations in use and alert on deviations.
- Track child process creation and outbound connections from the impalad service account.
- Forward Impala, Hadoop, and object storage logs to a centralized analytics tier for correlation and retention.
How to Mitigate CVE-2026-65181
Immediate Actions Required
- Upgrade all Impala deployments to version 4.5.2 or later without delay.
- Inventory existing Data Source tables and review the JAR locations and classes they reference.
- Restrict CREATE privileges on Impala so only trusted operators can register Data Source tables.
- Remove or tighten write access to storage locations that Impala loads JAR files from.
Patch Information
Apache Impala 4.5.2 contains the fix for CVE-2026-65181. Refer to the Apache Security Discussion thread and the Openwall OSS-Security Update for release details and upgrade guidance.
Workarounds
- Revoke Data Source creation privileges from non-administrative roles until the upgrade is complete.
- Enforce storage-level access controls so only vetted principals can write JAR files to Impala-accessible paths.
- Isolate the Impala service account with least-privilege operating system and network permissions to limit blast radius if code execution occurs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
