CVE-2026-90466

Executive Summary

CVE-2026-90466 is a path traversal vulnerability in Apache Impala 4.5.2 involving the startup configuration flag trusted_jar_paths. When an administrator configures trusted_jar_paths with a non-empty value, an attacker can craft a relative path whose prefix matches a trusted path entry, causing Impala to load an attacker-uploaded JAR from a different filesystem location. This enables loading of arbitrary attacker-controlled Java code into the Impala daemon, potentially leading to remote code execution within the Impala process context. Only Impala deployments with a non-empty trusted_jar_paths configuration are affected.

Technical Analysis

Apache Impala uses the trusted_jar_paths startup flag to define a set of URIs from which JAR files may be safely loaded. These URIs reference files on local or remote filesystems. The intent is to constrain JAR loading to administrator-approved locations, preventing users from loading arbitrary code via Impala DDL statements such as CREATE DATA SOURCE and CREATE TABLE.

The vulnerability (CWE-23, Relative Path Traversal) arises because the trusted-path validation performs prefix matching rather than canonical path resolution. An attacker who can upload a file to a filesystem location whose path string begins with a trusted path prefix can cause Impala to load that JAR even though it resides outside the intended trusted directory. Path traversal cannot override the URI schema (for example, it cannot switch between file:// and hdfs://), so the attacker must have write access to a location within the same filesystem namespace whose path shares a prefix with a configured trusted path.

Two conditions must be satisfied for exploitation:

1. trusted_jar_paths must have a non-empty value configured by the Impala administrator (without this, the code path is not reachable).
2. The attacker must be able to upload a JAR to a filesystem location whose path prefix matches an entry in trusted_jar_paths.

The upload primitive is provided by Impala DDL statements — CREATE DATA SOURCE and CREATE TABLE — which can place files on the underlying filesystem. Once a JAR is placed at a prefix-matching location, Impala's insufficient path validation allows it to be loaded as if it originated from the trusted location. Because JARs loaded by Impala execute Java code within the Impala daemon's JVM, successful exploitation results in arbitrary code execution under the privileges of the Impala process.

The exact comparison routine, canonicalization function, and DDL execution path are not detailed in the available advisory, so a precise code-level explanation cannot be provided. The vulnerability is best characterized as a relative path traversal affecting a path-allowlisting control.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-23) and the mechanisms described in the NVD advisory.

1. Reconnaissance / target identification. The attacker identifies an Apache Impala 4.5.2 deployment (commonly exposed on port 21050 for the Impala daemon / JDBC interface). The attacker determines whether the administrator has configured the trusted_jar_paths startup flag with a non-empty value, since the vulnerability is only reachable under that condition. The attacker also identifies which URIs (local or remote filesystem paths) are configured as trusted.

2. Triggering the flaw class. Using Impala DDL capabilities available to the attacker's session, the attacker leverages CREATE DATA SOURCE or CREATE TABLE statements to upload a malicious JAR to a filesystem location. The attacker chooses a location whose path begins with the prefix of a configured trusted_jar_paths entry but which points to a directory the attacker controls or can write to — a relative path traversal that satisfies the flawed prefix-match check while resolving to the attacker's upload location.

3. Payload / execution method (vulnerability-class level). The attacker references the uploaded JAR through a path that Impala's validation accepts because its prefix matches a trusted path. Impala then loads and instantiates the JAR within the daemon's JVM. The JAR contains attacker-controlled Java code that executes as part of Impala's normal JAR-loading workflow.

4. Post-exploitation impact. Because the JAR executes inside the Impala daemon process, the attacker achieves arbitrary code execution in that process context. Depending on the daemon's privileges and network position, this can enable data exfiltration from Impala-managed datasets, lateral movement to other cluster components, and persistence within the Impala service.

Note: No public exploit code, Nuclei template, or in-the-wild exploitation evidence is currently available for this CVE.

Impact Assessment

The CVSS score is not available from NVD (N/A), and FIRST.org has not yet assigned an EPSS score; no EPSS value should be assumed. The estimated CVSS vector provided above is a reasonable assessment based on the vulnerability class and impact description, not an authoritative vendor score.

The primary impact is arbitrary code execution within the Apache Impala daemon JVM, resulting from loading an attacker-controlled JAR. Confidentiality, integrity, and availability impacts are potentially high because the Impala process typically has access to large volumes of analytic data and to the underlying storage layer. The attack is network-reachable where the Impala daemon is exposed, requires the ability to submit DDL statements (a privilege that may be limited but is commonly granted to analysts and application accounts), and requires prior administrator configuration of trusted_jar_paths.

Blast radius is constrained by two factors: (1) exploitation is only possible when trusted_jar_paths is non-empty, and (2) the path traversal cannot override the URI schema, so the attacker is confined to the filesystem namespace of an already-trusted URI. Within those constraints, a successful attack compromises the Impala daemon and can expose data accessible to it. Deployments that have never set trusted_jar_paths (the default) are not affected.

Detection Guidance

Sigma Rule

title: Apache Impala Path Traversal via trusted_jar_paths JAR Loading
id: 8f3d2a41-impala-cve-2026-90466
status: experimental
description: Detects Impala DDL activity and JAR loading patterns consistent with CVE-2026-90466 path traversal abuse of trusted_jar_paths.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90466
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: impala
  service: audit
detection:
  selection_ddl:
    statement|contains:
      - 'CREATE DATA SOURCE'
      - 'CREATE TABLE'
  selection_jar:
    statement|contains:
      - '.jar'
      - 'trusted_jar_paths'
  condition: selection_ddl and selection_jar
  fields:
    - user
    - statement
    - client_address
level: high
tags:
  - attack.t1190
  - cwe.23

YARA Rule

rule CVE_2026_90466_Impala_TrustedJarPath_Traversal
{
    meta:
        description = "Detects Impala JAR artifacts referenced via relative path traversal against trusted_jar_paths (CVE-2026-90466)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90466"
        date = "2026-01-01"
        cwe = "CWE-23"
    strings:
        $jar_magic = { 50 4B 03 04 }
        $tp = "trusted_jar_paths" ascii wide nocase
        $dd1 = "CREATE DATA SOURCE" ascii wide nocase
        $dd2 = "CREATE TABLE" ascii wide nocase
        $traverse = "../" ascii wide
    condition:
        $jar_magic at 0 and
        (uint16(0) == 0x4B50) and
        any of ($dd1, $dd2) or
        ($tp and $traverse)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 21050 (msg:"CVE-2026-90466 Apache Impala trusted_jar_paths relative path traversal attempt"; flow:to_server,established; content:"CREATE"; nocase; content:"DATA SOURCE"; nocase; distance:0; content:".jar"; nocase; distance:0; pcre:"/(\.\.\/|\.\.\\)/Ui"; reference:cve,2026-90466; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90466; classtype:attempted-user; sid:20269046; rev:1;)

Elastic Detection

sequence by process.entity_id
  [ process where event.type == "start" and process.name == "impalad" ]
  [ file where event.category == "file" and file.extension == "jar" and
      file.path : "*/../*" ]

Splunk SPL Query

index=impala_audit (statement="*CREATE DATA SOURCE*" OR statement="*CREATE TABLE*") 
| where match(statement, "\.jar") AND match(statement, "\.\./") 
| stats count values(statement) as statements values(client_address) as sources by user 
| where count > 0

Wazuh OSSEC Rule

<group name="impala,cve-2026-90466,">
  <rule id="100846" level="12">
    <decoded_as>json</decoded_as>
    <field name="statement">\.jar</field>
    <field name="statement">CREATE</field>
    <regex>\.\./</regex>
    <description>CVE-2026-90466: Apache Impala potential trusted_jar_paths path traversal via JAR DDL</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no patch available):

   • Where operationally feasible, avoid setting trusted_jar_paths to a non-empty value, since the vulnerability is only reachable when it is configured. Deployments that do not require JAR loading should leave it unset.
   • If trusted_jar_paths must be configured, restrict the trusted locations to tightly-controlled directories, and ensure no user or service has write access to any path whose prefix matches a trusted entry.
   • Restrict the ability to submit CREATE DATA SOURCE and CREATE TABLE DDL statements to trusted accounts only; the vulnerability requires an upload primitive in the same filesystem namespace.
   • Network-segment the Impala daemon (port 21050) so that untrusted clients cannot reach it directly.

2. Patch / upgrade steps:

   • Upgrade Apache Impala to version 4.5.3, which the advisory states fixes this issue.
   • Because no independent patch evidence is currently tracked for this CVE, validate the upgrade against the vendor's release notes and confirm the specific fix is present in the deployed build before relying on it as the sole control.

3. Long-term hardening:

   • Replace prefix-based trusted-path validation with canonical path resolution (realpath/canonical URI comparison) so that relative traversal cannot match a trusted prefix — i.e., enforce that the resolved path is contained within an allowed directory.
   • Apply least-privilege controls to DDL verb submission so that JAR-upload-capable statements are granted only to administrators.
   • Monitor Impala audit logs for JAR-referencing DDL statements combined with traversal sequences (../ or ..\).
   • Maintain a configuration baseline so that unexpected changes to trusted_jar_paths are detected.

References

• NVD — CVE-2026-90466: https://nvd.nist.gov/vuln/detail/CVE-2026-90466
• Apache Impala project security page: https://impala.apache.org/ (consult the project's security and release notes for the 4.5.3 fix)
• MITRE CWE-23 (Relative Path Traversal): https://cwe.mitre.org/data/definitions/23.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog: no entry for CVE-2026-90466 (not listed as exploited in the wild at time of writing)

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-90466.