Apache Impala: Authentication bypass in executor webserver via JWT/OAuth
Summary
Apache Impala executors do not validate the signature of JWT/OAuth bearer tokens. If the executor webserver is configured to accept such tokens, an attacker can send any valid-looking JWT over the network without credentials and access resources served by that webserver. Apache rates the severity as low, while the CVSS score of 9.1 is critical; this conflict should be taken into account when prioritising.
Affected
- Apache Impala 4.1.0 through 4.5.2
- Only relevant where the executor webserver is configured to accept JWT/OAuth tokens; the default configuration is unaffected.
Fixed in
- Apache Impala 4.5.3
- Fixed versions for other maintenance branches: Unknown.
Workaround
- Disable JWT/OAuth authentication for Impala executors.
- Restrict network access to executor webserver ports to trusted administrative hosts.
Exploitation
- No evidence of exploitation in the wild found. VulDB states the CVE is not listed in CISA KEV.
- No public proof of concept found in the research.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all Impala installations and check the version and whether JWT/OAuth is enabled for executors.
- If JWT/OAuth is enabled, upgrade to Impala 4.5.3 or later, or disable it as an interim measure.
- Ensure executor webserver ports are not reachable from the internet or untrusted networks.
- Monitor webserver access logs for unexpected requests with bearer tokens.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread (CVE advisory) lists.apache.org
- oss-security post CVE-2026-97720 www.openwall.com
- Apache dev mailing list archive www.mail-archive.com
- CVE record summary (Vulners) vulners.com
- Cloudera documentation: Impala OAuth docs.cloudera.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:21.
Original description (NVD)
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.