CVE-2026-54048

Katalog CVE

CVSS 5.3 · Medium EPSS 0,54%

Kerentanan Server-Side Request Forgery (SSRF) pada apache impala. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Rincian

Terbit di NVD

9 September 2026

Terakhir diubah

10 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 44,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/09/08/21 mailing list · advisory pihak ketiga