Read the docs
TI-2026-38629 Aliases CVE-2026-53561GHSA-g32f-6xhp-3ffw

Improper authentication in Apache Hive

Priority LOW 34CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix for this issue. Access / authorization required: No Hive credentials, SAML IdP login, or knowledge of the server signing secret is required. The attacker only needs network reachability to the HiveServer2 HTTP port (typically /cliservice), directly or through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HS2. The instance must have SAML authentication enabled in HTTP mode. Deployments where Knox handles SSO and HiveServer2 uses LDAP/Kerberos (not native SAML mode) are not affected by this specific issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Hive4.0.0 – 4.2.0—No fix listedCNA
  • Apache Hive VendorApache Affected 4.0.0 – 4.2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*4.0.0 to before 4.2.1VulnerableApache
  • cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.2.1 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Hive — lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.urlPriority MEDIUM 49
    • TI-2026-36749 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL pathsPriority MEDIUM 45
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53561
  2. 2026-10-03 Alias added: GHSA-g32f-6xhp-3ffw

References

Patch 1

Advisory 2

Other 1

  • TI-2018-15196 Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CVSS 3.1CRITICAL 9.8
  • TI-2026-40376 Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url CVSS 3.1CRITICAL 9.1
  • TI-2018-01187 SQL injection in Apache Hive CVSS 3.0CRITICAL 9.1
  • TI-2026-36749 Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths CVSS 3.1CRITICAL 9.8
  • TI-2015-06259 The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1… CVSS 3.0HIGH 8.3
  • TI-2020-10925 Uncontrolled resource consumption in Apache Thrift CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences