← Vulnerability feed

Vulnerability record · CVE-2017-9792 · published 4 October 2017

CVE-2017-9792: Apache impala incorrect permission assignment vulnerability

Apache · Impala

In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the underlying table mapping to point to other Kudu tables. This violates and works around the authorization requirement that creating a Kudu external table via Impala requires an "ALL" privilege at the server scope. This privilege requirement for "CREATE" commands is enforced to precisely avoid this scenario where a malicious user can change the underlying Kudu table mapping. The fix is to enforce the same privilege requirement for "ALTER" commands that would make existing non-external Kudu tables external.

6.5 CVSS 3.0 Medium EPSS 1.6% · top 25.5% CWE-732 · Incorrect permission assignment
6.5CVSS 3.0 base score, v2 4.0
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the underlying table mapping to point to other Kudu tables. This violates and works around the authorization requirement that creating a Kudu external table via Impala requires an "ALL" privilege at the server scope. This privilege requirement for "CREATE" commands is enforced to precisely avoid this scenario where a malicious user can change the underlying Kudu table mapping. The fix is to enforce the same privilege requirement for "ALTER" commands that would make existing non-external Kudu tables external.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/101173 Third Party AdvisoryVDB Entry
https://issues.apache.org/jira/browse/IMPALA-5638 Issue TrackingVendor Advisory
https://lists.apache.org/thread.html/74a163df0cdefcd738c8d18821e69aa69eed2ba5384c0cc255d15c4b%40%3Cannounce.apache.org%3
http://www.securityfocus.com/bid/101173 Third Party AdvisoryVDB Entry
https://issues.apache.org/jira/browse/IMPALA-5638 Issue TrackingVendor Advisory
https://lists.apache.org/thread.html/74a163df0cdefcd738c8d18821e69aa69eed2ba5384c0cc255d15c4b%40%3Cannounce.apache.org%3

Track CVE-2017-9792 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-56207Apache impala improper verification of cryptographic signature vulnerabilitySignature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and actin…EPSS 0.46%9.8CVE-2018-11792Apache impala incorrect permission assignment vulnerabilityIn Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER…EPSS 2.5%9.8CVE-2017-5640Apache impala improper authentication vulnerabilityIt was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to ski…EPSS 2.9%8.8CVE-2026-57866Apache impala server-side request forgery (ssrf) vulnerabilityServer side request forgery in Apache Impala versions 4.4.x and 4.5.x.  Authenticated Impala users with permissions to execute the ai_generate_text()…EPSS 0.58%8.1CVE-2026-65181Apache impala improper control of dynamically-managed code vulnerabilityInsufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a ta…EPSS 0.54%7.5CVE-2021-28131Apache impala authentication bypass via alternate path vulnerabilityImpala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala lo…EPSS 3.3%7.5CVE-2019-10084Apache impala missing encryption vulnerabilityIn Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions o…EPSS 0.99%7.5CVE-2017-5652Apache impala cleartext transmission vulnerabilityDuring a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when …EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2017-9792), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.