CVE-2026-97720

Published: Oct 7, 2026Modified: Oct 7, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.

Related CWEs

CWE-303

Incorrect Implementation of Authentication Algorithm

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

References (2)

https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/10/07/22

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.