CVE-2026-90466 Overview
CVE-2026-90466 is a path traversal vulnerability [CWE-23] in Apache Impala 4.5.2. The flaw affects the trusted_jar_paths startup flag, which references URIs for loading files from local or remote filesystems. An attacker can supply a relative path whose prefix matches a trusted path, causing Impala to load an attacker-controlled JAR. The malicious JAR must first be uploaded to a reachable location using Impala Data Definition Language (DDL) statements such as CREATE DATA SOURCE or CREATE TABLE. Exploitation requires that an Impala administrator has configured trusted_jar_paths with a non-empty value. Apache has released Impala 4.5.3 to address the issue.
Critical Impact
Successful exploitation allows loading of attacker-controlled JAR files inside the Impala process, enabling arbitrary code execution within the trust boundary of the Impala service.
Affected Products
- Apache Impala 4.5.2
- Deployments with trusted_jar_paths configured to a non-empty value
- Fixed in Apache Impala 4.5.3
Discovery Timeline
- 2026-10-07 - CVE-2026-90466 published to the National Vulnerability Database (NVD)
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-90466
Vulnerability Analysis
The vulnerability resides in how Impala validates JAR file paths against the trusted_jar_paths allow-list. Impala performs a prefix match on the supplied URI rather than canonicalizing the path before comparison. An attacker who can submit a JAR reference and influence the path argument can therefore use .. segments to traverse outside the intended trusted directory. The schema portion of the URI cannot be overridden, so the attack is bounded to the same filesystem as the trusted path. However, Impala DDL statements such as CREATE DATA SOURCE and CREATE TABLE allow users to upload or stage JAR files to arbitrary writable locations in that filesystem. The combination of a weak prefix check and user-controlled uploads turns the trusted-path mechanism into a code-loading primitive. See the Apache Mailing List Thread and Openwall OSS Security Update for upstream disclosure details.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-23]. Impala compared the user-supplied JAR URI against entries in trusted_jar_paths using prefix matching without resolving .. traversal sequences or normalizing the path.
Attack Vector
An authenticated user with privileges to execute Impala DDL statements stages a malicious JAR using CREATE DATA SOURCE or CREATE TABLE. The user then references that JAR with a crafted relative path whose prefix matches an entry in trusted_jar_paths but traverses to the uploaded JAR. Impala loads the attacker-controlled JAR as if it were trusted, executing its code within the Impala service context.
No verified exploit code is available. Refer to the Apache advisory for technical specifics.
Detection Methods for CVE-2026-90466
Indicators of Compromise
- Unexpected CREATE DATA SOURCE or CREATE TABLE statements that reference JAR files staged to non-standard filesystem locations.
- JAR load events in Impala logs where the resolved path contains .. traversal sequences or resolves outside the configured trusted_jar_paths directories.
- New or modified JAR files appearing in HDFS, S3, or local directories that are not part of normal deployment pipelines.
Detection Strategies
- Audit Impala query history for DDL that uploads or references JAR files, focusing on paths that include relative segments.
- Correlate Impala coordinator and executor logs with filesystem write events to identify JAR files staged outside approved locations.
- Alert when the Impala process loads a class from a JAR whose canonical path differs from the configured trusted directories.
Monitoring Recommendations
- Enable verbose logging for Impala JAR-loading subsystems and forward logs to a centralized analytics platform.
- Monitor filesystem permissions and write activity on directories referenced by trusted_jar_paths and their parent directories.
- Track changes to the Impala startup configuration, specifically the value of the trusted_jar_paths flag.
How to Mitigate CVE-2026-90466
Immediate Actions Required
- Upgrade all Apache Impala deployments from 4.5.2 to version 4.5.3.
- Inventory any Impala instances configured with a non-empty trusted_jar_paths and prioritize them for patching.
- Review recent DDL activity for suspicious JAR uploads prior to patching.
Patch Information
Apache Impala 4.5.3 fixes the path traversal flaw. Users are recommended to upgrade to this version. Refer to the Apache Mailing List Thread for release details.
Workarounds
- Set trusted_jar_paths to an empty value until the upgrade can be completed, which eliminates the required precondition for exploitation.
- Restrict Impala DDL privileges so that only trusted operators can execute CREATE DATA SOURCE and CREATE TABLE statements that reference external JARs.
- Apply strict filesystem permissions on directories referenced by trusted_jar_paths to prevent unauthorized writes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
