CVE-2026-97720: Apache Impala JWT Authentication Bypass

CVE-2026-97720 Overview

CVE-2026-97720 is an authentication bypass vulnerability in Apache Impala executors. The flaw affects all versions up to and including 4.5.2. Impala executors incorrectly implement JSON Web Token (JWT) and OAuth authentication on the executor webserver. The webserver accepts any syntactically valid JWT because bearer token signatures are not validated. An attacker who can reach the executor webserver can access resources served by that interface when JWT/OAuth authentication is enabled. The project classifies the root cause under [CWE-303: Incorrect Implementation of Authentication Algorithm].

Critical Impact

Unauthenticated access to Impala executor webserver resources via forged JWT bearer tokens when JWT/OAuth authentication is configured.

Affected Products

• Apache Impala versions up to and including 4.5.2
• Impala executor component (webserver interface)
• Deployments configured to accept JWT/OAuth tokens on the executor webserver

Discovery Timeline

• 2026-10-07 - CVE-2026-97720 published to the National Vulnerability Database (NVD)
• 2026-10-07 - Last updated in NVD database
• 2026-10-07 - Public disclosure via Apache Mailing List Thread and Openwall OSS Security Discussion

Technical Details for CVE-2026-97720

Vulnerability Analysis

Apache Impala is a distributed SQL query engine for Apache Hadoop. Impala executor nodes expose a webserver for diagnostics and resource access. When operators configure the executor webserver to use JWT or OAuth bearer-token authentication, the executor is expected to validate the token signature against a trusted key. In vulnerable versions, the signature validation step is missing. The server treats any well-formed JWT as authentic. An attacker with network access to the executor webserver can craft a token with arbitrary claims and gain access to resources protected by that authentication layer.

Root Cause

The root cause is an incomplete authentication implementation in the executor webserver, tracked as [CWE-303]. The JWT verification path parses the token structure but never performs cryptographic signature verification against the issuer's signing key. As a result, trust is placed in the token's claims without proof that an authorized issuer produced them.

Attack Vector

Exploitation requires network reachability to the Impala executor webserver and a configuration that accepts JWT/OAuth tokens. The attacker constructs a JWT with any header, payload, and signature values. The attacker then submits the token in the Authorization: Bearer HTTP header to a request against the executor webserver. The webserver accepts the request and returns the protected resource. No credentials, prior authentication, or key material are required. Technical details are available in the Apache Mailing List Thread and the Openwall OSS Security Discussion.

Detection Methods for CVE-2026-97720

Indicators of Compromise

• Requests to Impala executor webserver endpoints containing Authorization: Bearer headers from unexpected source addresses.
• JWT values in access logs with unknown issuer (iss) claims or signatures that do not match the configured identity provider's keys.
• Access to executor webserver resources outside normal operator workflows or from hosts not registered as Impala clients.

Detection Strategies

• Enable verbose access logging on the Impala executor webserver and capture Authorization header metadata where policy permits.
• Correlate executor webserver access logs with identity provider token issuance logs to flag tokens that were never issued by the trusted authority.
• Inventory all Impala deployments and identify executors running versions at or below 4.5.2 with JWT/OAuth authentication enabled.

Monitoring Recommendations

• Alert on any HTTP 200 responses from executor webserver endpoints paired with JWTs whose signatures fail out-of-band validation.
• Monitor network flows to executor webserver ports from clients other than approved coordinators, operators, and management tools.
• Track configuration drift that enables JWT/OAuth authentication on executor webservers prior to upgrading to a fixed release.

How to Mitigate CVE-2026-97720

Immediate Actions Required

• Upgrade Apache Impala to version 4.5.3 or later, which validates JWT signatures on the executor webserver.
• If upgrading is not immediately possible, disable JWT/OAuth authentication on the Impala executor webserver.
• Restrict network access to the executor webserver using firewalls or network policy so that only trusted management hosts can reach it.
• Review access logs for the executor webserver covering the exposure window and rotate any secrets that may have been accessed.

Patch Information

The Apache Impala project fixed this issue in version 4.5.3. The fix adds proper cryptographic signature validation for JWT bearer tokens on the executor webserver. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

• Disable JWT/OAuth authentication on the Impala executor webserver until the upgrade to 4.5.3 is applied.
• Place the executor webserver behind an authenticating reverse proxy that performs independent JWT signature validation.
• Segment the Impala cluster network so that executor webservers are not reachable from untrusted zones.

# Configuration example: disable JWT/OAuth on the executor webserver
# Review Impala startup flags for the executor and remove or set to false:
--jwt_token_auth=false
--oauth_token_auth=false
# Then restart the Impala executor process to apply the change.