Read the docs
TI-2026-36749 Aliases CVE-2026-49845GHSA-5555-2x3r-gmgx

Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

Priority MEDIUM 45CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue. Details about the issue: Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00891 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Hive4.0.0 – 4.2.0—No fix listedCNA
  • Apache Hive VendorApache Affected 4.0.0 – 4.2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:hive:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableApache
  • cpe:2.3:a:apache:hive:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Hive — lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.urlPriority MEDIUM 49
    • TI-2026-38629 Improper authentication in Apache HivePriority LOW 34
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49845
  2. 2026-10-03 Alias added: GHSA-5555-2x3r-gmgx
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2018-15196 Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CVSS 3.1CRITICAL 9.8
  • TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVSS 3.1CRITICAL 9.1
  • TI-2018-01187 SQL injection in Apache Hive CVSS 3.0CRITICAL 9.1
  • TI-2015-06259 The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1… CVSS 3.0HIGH 8.3
  • TI-2020-10925 Uncontrolled resource consumption in Apache Thrift CVSS 3.1HIGH 7.5
  • TI-2015-01590 The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before… CVSS 3.0HIGH 7.3
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences