CVE-2026-54048: 
Apache Impala vulnerability analysis and mitigation

CVE-2026-54048 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Impala, titled "Avro Schema URL Server-Side Request Forgery." It affects Apache Impala versions 2.0.0 through 4.5.1 on all platforms, and was disclosed on September 8, 2026, with a fix released in version 4.5.2. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Apache Advisory, GitHub Advisory). The vulnerability was reported by zhaokaifei of ChinaTelecom (OSS-Sec).

The root cause is improper handling of the avro.schema.url table property in Apache Impala's DDL processing, classified as CWE-918 (Server-Side Request Forgery). An attacker can specify a malicious http:// or file:/// URI via tblproperties('avro.schema.url'='http://...') when creating or altering a table, causing Impala to issue a GET request to an arbitrary internal or local endpoint on behalf of the server. The response content from that internal endpoint may then be exposed through Impala's parsing error messages, leaking sensitive data. No authentication is required to exploit this vulnerability, and the attack can be performed entirely over the network (OSS-Sec, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to trigger GET requests from the Impala server to internal network endpoints or local files that the attacker cannot directly access, with response content potentially leaked via error messages. This primarily results in a confidentiality impact — exposure of sensitive internal service responses, metadata, or file contents — with no direct integrity or availability impact. In environments where Impala has broad internal network access (e.g., cloud metadata services, internal APIs), the data exposure risk could be significant (Apache Advisory, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.20% (Feedly data), indicating a low near-term exploitation probability. However, the attack is network-accessible, requires no authentication, and is automatable, which lowers the barrier for exploitation if a PoC were to emerge.

1. Reconnaissance: Identify Apache Impala instances (versions 2.0.0–4.5.1) accessible over the network, using service banners, Shodan, or internal asset inventories.
2. Gain DDL access: Obtain access to Impala's query interface (e.g., Impala Shell, JDBC/ODBC, or HUE) — note that no authentication may be required depending on deployment configuration.
3. Craft malicious DDL statement: Issue a CREATE TABLE or ALTER TABLE statement specifying a malicious avro.schema.url property pointing to an internal endpoint or local file, e.g.:

   CREATE TABLE ssrf_test (id INT)
   STORED AS AVRO
   TBLPROPERTIES ('avro.schema.url'='http://169.254.169.254/latest/meta-data/');

4. Trigger SSRF: Impala processes the DDL and issues a GET request to the specified URL (e.g., a cloud metadata endpoint or internal service).
5. Extract data from error messages: Observe the error message returned by Impala, which may contain the response body from the internal endpoint, revealing sensitive information such as cloud credentials, internal service data, or file contents (OSS-Sec, GitHub Advisory).

• Logs: Impala query logs containing CREATE TABLE or ALTER TABLE statements with avro.schema.url set to http://, https://, or file:/// URIs pointing to internal IP ranges (e.g., 169.254.169.254, 10.x.x.x, 192.168.x.x) or local file paths.
• Network: Unexpected outbound HTTP GET requests from the Impala server process to internal network endpoints, cloud metadata services (e.g., 169.254.169.254), or loopback addresses.
• Logs: Impala error logs containing response content from internal services embedded within schema parsing error messages.
• Process: Impala daemon (impalad) initiating HTTP connections to non-standard or internal destinations not associated with normal Avro schema retrieval.

The primary remediation is to upgrade Apache Impala to version 4.5.2 or later, which resolves this vulnerability (Apache Advisory). As a network-level workaround prior to patching, restrict outbound HTTP/HTTPS connections from Impala servers to only trusted, necessary endpoints using firewall rules or egress filtering. Additionally, enforce strict access controls on who can execute DDL statements against Impala to limit the attack surface.

The vulnerability was covered by security news aggregators including SecurityOnline.info and tracked by VulDB and CVEFeed shortly after disclosure. A blog post on bulwarkblack.com discussed the vulnerability in the context of SSRF and data platform security. No major vendor statements beyond the Apache advisory or notable researcher commentary have been identified at this time.