CVE-2026-97720
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions…
- Risk score
- 64/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulti…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.5.3 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Last activity 7 Oct 2026. Patch Forecast updates every hour.