Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin.
Users are recommended to upgrade to version 4.5.3, which fixes this issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread.html/m7qbho4j1g4v7kx7pbk4z2n8p9nx6bqn | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/10/07/20 | Mailing List Third Party Advisory |
Configurations
History
13 Oct 2026, 14:27
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:impala:4.5.2:-:*:*:*:*:*:* | |
| First Time |
Apache impala
Apache |
|
| References | () https://lists.apache.org/thread.html/m7qbho4j1g4v7kx7pbk4z2n8p9nx6bqn - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/10/07/20 - Mailing List, Third Party Advisory |
07 Oct 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
07 Oct 2026, 10:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Oct 2026, 09:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-07 09:17
Updated : 2026-10-13 14:27
NVD link : CVE-2026-90466
Mitre link : CVE-2026-90466
CVE.ORG link : CVE-2026-90466
JSON object : View
Products Affected
apache
- impala
CWE
CWE-23
Relative Path Traversal