Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Apache Hive — lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05 Clear all filters
TI-2026-36749 CVE-2026-49845 · GHSA-5555-2x3r-gmgx

Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

Priority MEDIUM 45

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partit…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00891 Published 2026-08-25 No fix listed CWE-94
TI-2026-40376 CVE-2026-55976 · GHSA-gp8m-92x3-q87g

Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url

Priority MEDIUM 49

Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01038 Published 2026-08-25 No fix listed CWE-918
TI-2026-38629 CVE-2026-53561 · GHSA-g32f-6xhp-3ffw

Improper authentication in Apache Hive

Priority LOW 34

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00339 Published 2026-08-25 No fix listed CWE-287