CVE-2026-93684: Apache Impala Stored XSS Vulnerability

CVE-2026-93684 Overview

CVE-2026-93684 is a stored Cross-Site Scripting (XSS) vulnerability in Apache Impala versions up to and including 4.5.2. An SQL user with only SELECT permission can embed JavaScript inside a table alias. The payload executes in another user's browser when that user opens the query plan in Impala's Web UI. The weakness is tracked as CWE-79. Apache recommends upgrading to version 4.5.3.

Critical Impact
A low-privileged SQL user can execute arbitrary JavaScript in the browser session of any administrator or analyst who views the malicious query plan in the Impala Web UI.

Affected Products

Apache Impala versions up to and including 4.5.2
Impala Web UI query plan rendering component
Deployments exposing the Impala Web UI to multi-tenant SQL users

Discovery Timeline

2026-10-07 - CVE CVE-2026-93684 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-93684

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Apache Impala's Web UI. Impala renders query plans in HTML without sufficiently sanitizing SQL identifiers supplied by users. A user with SELECT privileges can craft a query that uses a table alias containing JavaScript. When the server stores or echoes that query plan, the alias is included verbatim in the Web UI output. Any authenticated Web UI user who views the plan triggers execution of the injected script in their browser. The attacker therefore inherits the victim's Impala Web UI context, which commonly includes administrative visibility over cluster activity.

Root Cause

The root cause is missing output encoding of user-controlled SQL identifiers in the query plan view. Table aliases are treated as trusted display strings instead of untrusted input. Because the malicious alias is persisted inside stored query plan data, the issue qualifies as stored rather than reflected XSS.

Attack Vector

An authenticated SQL user with only SELECT permission submits a query that assigns a JavaScript payload as a table alias. A privileged user later opens that query plan in the Impala Web UI. The browser parses the alias as HTML and runs the attacker's script in the Web UI origin. See the Apache Mailing List Thread and the OpenWall OSS Security Discussion for the vendor's description.

// No verified exploit code is published. See the Apache advisory for technical details.

Detection Methods for CVE-2026-93684

Indicators of Compromise

Queries submitted to Impala in which table aliases contain HTML tags, <script> fragments, or javascript: URIs.
Entries in Impala query history where alias fields include angle brackets, event handlers such as onerror=, or encoded script payloads.
Impala Web UI sessions where administrator browsers issue unexpected outbound requests shortly after opening a query plan.

Detection Strategies

Audit the Impala query log for identifiers containing non-SQL characters and reject or flag suspicious aliases.
Deploy browser-side Content Security Policy (CSP) reporting to surface inline script execution within the Impala Web UI origin.
Correlate Web UI access logs with query plan views to identify which users rendered attacker-controlled plans.

Monitoring Recommendations

Forward Impala query history and Web UI access logs to a central analytics platform for retrospective hunting.
Alert on authenticated users who submit SQL identifiers exceeding expected length or containing HTML metacharacters.
Monitor administrator browser sessions for anomalous DOM activity or script-sourced network calls originating from the Impala Web UI.

How to Mitigate CVE-2026-93684

Immediate Actions Required

Upgrade Apache Impala to version 4.5.3 or later on all coordinator and Web UI hosts.
Restrict access to the Impala Web UI to trusted operators pending the upgrade.
Review existing stored query plans and purge entries that contain untrusted HTML or script content in aliases.

Patch Information

Apache has released Apache Impala 4.5.3, which addresses the stored XSS flaw in the Web UI query plan rendering path. Refer to the Apache Mailing List Thread for release details.

Workarounds

Block or firewall the Impala Web UI port from general user networks and permit only administrator subnets.
Enforce strict authentication and role separation so that only vetted users can submit queries while the patch is deployed.
Apply a reverse-proxy Content Security Policy that blocks inline script execution in the Web UI origin.

bash

# Upgrade example (adjust for your package manager and deployment)
# 1. Stop Impala services
sudo systemctl stop impala-server impala-catalog impala-statestore

# 2. Install Apache Impala 4.5.3 package per your distribution

# 3. Restart services and confirm the Web UI reports version 4.5.3
sudo systemctl start impala-statestore impala-catalog impala-server
curl -s http://<impala-host>:25000/ | grep -i version