Apache Software Foundation Apache Impala vulnerabilities

2 CVEs affecting Apache Software Foundation Apache Impala, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97720, published 2026-10-07.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-97720, published 2026-10-07. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's…
• CVE-2026-93684, published 2026-10-07. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query…