CVE-2026-49845: 
Homebrew vulnerability analysis and mitigation

CVE-2026-49845 is a SQL injection vulnerability in the Apache Hive Metastore's direct SQL partition-name resolution path, affecting Apache Hive versions before 4.2.1 (specifically confirmed for 4.0.0–4.2.0). It allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata by supplying crafted partition names in metastore RPC requests when direct SQL is enabled (the default configuration). The vulnerability was published on August 25, 2026, with a patch released in Apache Hive 4.2.1. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Apache Advisory).

The root cause is improper neutralization of user-supplied input in SQL query construction, classified as CWE-94 (Improper Control of Generation of Code). Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers; in these paths, the DirectSqlUpdatePart.quoteString() method embedded client-supplied partition names into SQL via string concatenation ('...') rather than parameterized bind variables. An attacker can supply a partition name containing a single quote and crafted SQL (e.g., test_part_col=missing') OR 1=1 --) to alter the generated WHERE clause, causing lookups intended for one partition to match additional unintended rows. The fix (commit ca64f08) replaces string concatenation with PreparedStatement parameterization in both DirectSqlUpdatePart.java and MetaStoreDirectSql.java, and removes the vulnerable quoteString() helper entirely (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated attacker to read, modify, or corrupt partition metadata across multiple partitions within tables they can reference, including statistics updates, truncation targets, and file-metadata cache operations. The impact is primarily scoped to table and partition metadata — it does not provide arbitrary cross-database access on its own — but can lead to data integrity loss, incorrect query results, unintended data truncation or deletion, and disruption of Hive's metadata-driven operations. Given the CVSS score of 9.8, confidentiality, integrity, and availability are all rated as high impact (GitHub Advisory, Apache Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.335% (26th percentile), indicating a relatively low near-term exploitation probability. Exploitation requires authentication or network-trusted access to the Hive Metastore API, and the attack is not automatable according to NVD SSVC assessment (GitHub Advisory).

1. Gain Metastore Access: Obtain authenticated or network-trusted access to the Hive Metastore RPC interface (default port 9083), either as a legitimate Hive user or via a compromised client on a trusted network segment.
2. Identify Target Table: Enumerate accessible tables and their partition schemas using standard Hive Metastore API calls (e.g., get_all_tables, get_partition_names).
3. Craft Malicious Partition Name: Construct a partition name containing a SQL injection payload, such as test_part_col=value') OR 1=1 --, designed to break out of the quoted string context in the generated SQL WHERE clause.
4. Submit via Metastore RPC: Invoke a vulnerable Metastore RPC that accepts partition names — such as get_partitions_by_names, update_partition_column_statistics, or drop_partitions — passing the crafted partition name as input.
5. Achieve Unintended Data Access or Modification: The injected SQL alters the WHERE clause to match additional rows beyond the intended partition, enabling reads of unintended partition metadata, corruption of statistics, unintended truncation, or cache poisoning across multiple partitions in the target table (GitHub Advisory, GitHub Commit).

• Network: Unexpected or anomalous RPC calls to the Hive Metastore service (default port 9083) from unusual source IPs or at unusual times; high-volume partition-name lookup requests from a single client.
• Logs: Hive Metastore logs (metastore.log) showing partition-name API calls with values containing single quotes ('), SQL keywords (OR, AND, --, 1=1), or other SQL metacharacters in the PART_NAME field.
• Logs: Unexpected partition metadata changes (statistics updates, truncations, or drops) affecting partitions not targeted by legitimate workloads, visible in Metastore audit logs or HMS operation logs.
• File System / Metadata: Partition statistics (e.g., numNulls, numDVs) showing unexpected values inconsistent with actual data, or partitions being dropped/truncated without corresponding ETL job activity (GitHub Advisory).

Upgrade to Apache Hive 4.2.1, which replaces the vulnerable string-concatenation SQL construction with parameterized PreparedStatement queries in the affected direct-SQL paths (GitHub Advisory, Apache Advisory). As a temporary workaround if immediate patching is not feasible, disable direct SQL mode by setting metastore.try.direct.sql=false in the Hive Metastore configuration — note this may degrade performance as it falls back to JDO-based queries. Additionally, restrict access to the Hive Metastore API to only trusted, authorized users and network segments to reduce the attack surface.