---
id: CVE-2026-54048
title: >-
  Specifying tblproperties('avro.schema.url'=' http://...' ) or with a
  'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an
  attacker to trigger a GET request to internal endpoints they may not have
  access to but th…
summary: >-
  Specifying tblproperties('avro.schema.url'=' http://...' ) or with a
  'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an
  attacker to trigger a GET request to internal endpoints they may not have
  access to but th…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: apache
product: impala
affected:
  - 'impala >= 2.7.0, < 4.5.2'
patched:
  - impala 4.5.2
published: '2026-09-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:38:42.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54048'
references:
  - url: 'https://lists.apache.org/thread/cn3q4s8yx924ndlm3gt04o6g4rfm980c'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/08/21'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-10T17:58:58.345579Z'
ingestedAt: '2026-09-11T16:15:14.725Z'
epss: 0.00583
epssPercentile: 0.46603
---

## Overview

Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.

## Affected

- `impala >= 2.7.0, < 4.5.2`

## Remediation

Upgrade past the affected range:

- `impala 4.5.2`