CVE-2026-93684

Executive Summary

CVE-2026-93684 is a stored cross-site scripting (XSS) vulnerability in Apache Impala up to and including version 4.5.2. A user with only SELECT privileges can embed JavaScript in a table alias within a SQL query; when another user opens the affected query plan in Impala's Web UI, the script executes in that victim's browser context. This enables session hijacking, credential theft, and actions performed with the victim's privileges, including potentially higher-privileged administrators viewing query plans.

Technical Analysis

The vulnerability resides in how Impala's Web UI renders query plans without properly neutralizing user-supplied SQL identifiers. Per the NVD description, a low-privileged SQL user (SELECT permission only) can supply a table alias containing JavaScript, and this value is subsequently displayed unsanitized in the query plan view of the Web UI. Because table aliases are reflected into HTML output without context-appropriate encoding, the injected script is stored and later executed when a different user views the query plan.

This is a classic CWE-79 stored XSS: the injection point is the SQL table alias, the persistence mechanism is the stored query plan, and the trigger is the rendering of that plan in a browser. The attacker requires only SELECT privileges, meaning no administrative access is needed to plant the payload — a notable privilege-escalation-adjacent risk given that query plans are frequently reviewed by DBAs and administrators with broader access.

No CVSS score or vector is assigned in the provided data; the vector above is an inferred assessment based on the vulnerability class and should be treated as provisional. No public PoC, Nuclei template, or exploit code is available. The exact HTML sink and the specific rendering component are not detailed in the available description; accordingly, only the vulnerability class and mechanism are asserted here.

Exploitation Scenarios

Based strictly on the NVD description:

1. Reconnaissance / target identification: The attacker identifies an Apache Impala deployment running version 4.5.2 or earlier whose Web UI is reachable and used by other personnel. The attacker holds a valid SQL account with SELECT permission.

2. Triggering the flaw class: The attacker issues SQL queries in which a table alias contains JavaScript. A table alias is a user-controlled identifier, and the flaw is that this value is stored and later reflected into HTML without sanitization.

3. Payload / execution method: Because the alias is embedded in the query plan and stored, the malicious string persists. When another user (e.g., a DBA or administrator) opens that query plan in Impala's Web UI, the embedded JavaScript runs in the victim's browser as a stored XSS payload.

4. Post-exploitation impact: Execution in the victim's browser context allows actions limited only by the victim's session and permissions — such as reading data available to that session or performing UI-driven actions under the victim's identity. The attacker's initial SELECT-only privilege does not constrain the impact, since execution occurs in the higher-privileged victim's browser.

No public PoC is available; the attack chain is inferred from the vulnerability class.

Impact Assessment

The primary impact is stored XSS affecting any user who views a tainted query plan in the Impala Web UI. Because the injection is persisted server-side, exploitation requires no interaction with the original attacker beyond a victim opening the query plan. Scope is considered changed (S:C in the inferred vector), since execution occurs in a different user's browser context than the attacker's. Confidentiality and integrity impacts are low-to-moderate per the inferred vector; availability is not directly affected. The blast radius is bounded by which users access the Web UI and view the poisoned query plan — notably administrators, amplifying credential and session theft risk.

Detection Guidance

Sigma Rule

title: Potential Impala Stored XSS via Malicious Table Alias in Query Plan
id: 8f2a1c3e-impala-xss-93684
status: experimental
description: Detects SQL text containing script-like content within table aliases that may indicate stored XSS injection into Impala Web UI query plans.
logsource:
  product: impala
  service: audit
detection:
  keywords:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
    - '</script>'
  sql_context:
    - 'AS '
    - 'alias'
  condition: keywords and sql_context
falsepositives:
  - Legitimate queries containing string literals with HTML
level: medium

YARA Rule

rule CVE_2026_93684_Impala_Stored_XSS
{
    meta:
        description = "Detects script injection payloads targeting Impala Web UI query plan stored XSS"
        cve = "CVE-2026-93684"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93684"
    strings:
        $s1 = "<script" nocase
        $s2 = "</script>" nocase
        $s3 = "javascript:" nocase
        $s4 = "onerror=" nocase
        $s5 = "onload=" nocase
        $alias = " AS " nocase
    condition:
        $alias and any of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93684 Apache Impala Stored XSS Attempt via Table Alias"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"impala"; content:"<script"; nocase; http_client_body; content:"<script"; nocase; classtype:web-application-attack; sid:202693684; rev:1;)

Elastic Detection

sequence by user.name
  [ process where event.category == "database" and process.command_line : "*AS*" and process.command_line : ("*<script*" or "*javascript:*" or "*onerror=*") ]

Splunk SPL Query

index=impala sourcetype=impala_audit
| search query="*AS*" (query="*<script*" OR query="*javascript:*" OR query="*onerror=*" OR query="*onload=*")
| table _time, user, query, src_ip
| sort - _time

Wazuh OSSEC Rule

<group name="impala,web,">
  <rule id="100684" level="10">
    <decoded_as>json</decoded_as>
    <field name="query">\.*&lt;script|javascript:|onerror=|onload=</field>
    <description>CVE-2026-93684: Possible Impala stored XSS payload in SQL query/table alias</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict Web UI access to trusted networks/users; require authentication and least privilege for all Web UI viewers; encode/monitor SQL identifiers containing script-like tokens. Where feasible, disable or gate query-plan viewing for untrusted query authors.

2. Patch/upgrade steps: The NVD description recommends upgrading to Apache Impala 4.5.3, which addresses the flaw. Track the release and apply promptly once verified. No patch artifact is currently available from tracked sources.

3. Long-term hardening: Enforce context-aware output encoding for all user-controlled values rendered in the Web UI; add security review of query-plan rendering; restrict SELECT users from generating artifacts visible to higher-privileged viewers; monitor audit logs for anomalous aliases.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93684
• MITRE CWE-79: https://cwe.mitre.org/data/definitions/79.html
• Apache Impala: https://impala.apache.org/
• MITRE ATT&CK T1059.007: https://attack.mitre.org/techniques/T1059/007/
• CISA KEV: Not applicable (CVE not listed). No known threat actor campaigns or exploit-in-the-wild evidence reported.