Vulnerability record · CVE-2026-56207 · published 9 September 2026

CVE-2026-56207: Apache impala improper verification of cryptographic signature vulnerability

Apache · Impala

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

9.8 CVSS 3.1 Critical EPSS 0.46% · top 62.2% CWE-347 · Improper verification of cryptographic signature

9.8CVSS 3.1 base score

0.46%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

10 Sep 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Impala Apache

References

Link	Tags
https://lists.apache.org/thread/20cov78py0zqzx7dyq39ktythkwn91zs	Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/08/22	Mailing ListThird Party Advisory

Track CVE-2026-56207 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-11792Apache impala incorrect permission assignment vulnerabilityIn Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER…EPSS 2.5%24 Oct 2018 9.8CVE-2017-5640Apache impala improper authentication vulnerabilityIt was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to ski…EPSS 2.9%10 Jul 2017 8.8CVE-2026-57866Apache impala server-side request forgery (ssrf) vulnerabilityServer side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text()…EPSS 0.58%9 Sep 2026 8.1CVE-2026-65181Apache impala improper control of dynamically-managed code vulnerabilityInsufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a ta…EPSS 0.54%9 Sep 2026 7.5CVE-2021-28131Apache impala authentication bypass via alternate path vulnerabilityImpala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala lo…EPSS 3.3%22 Jul 2021 7.5CVE-2019-10084Apache impala missing encryption vulnerabilityIn Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions o…EPSS 0.99%5 Nov 2019 7.5CVE-2017-5652Apache impala cleartext transmission vulnerabilityDuring a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when …EPSS 1.2%10 Jul 2017 6.5CVE-2018-11785Apache impala missing authorization vulnerabilityMissing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running …EPSS 1.2%24 Oct 2018

Source: NIST National Vulnerability Database (record CVE-2026-56207), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.