Vulnerability-Lookup

CVE-2026-55976 (GCVE-0-2026-55976)

Vulnerability from cvelistv5 – Published: 2026-08-25 10:13 – Updated: 2026-08-26 18:50

Title

Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url

Summary

Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue. Attacker access requirements: * Network access to HiveServer2 / Metastore: required (remote attacker model). * Valid Hive authentication: required. * CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url in table properties. * SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch. * Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path. * Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient. * External tables enabled: typically required in practice, and enabled by default in most deployments. Detection guidance: * Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts. * Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url. * Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution. * On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:50 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

apache mitre root

References

4 references

URL	Tags
https://github.com/apache/hive	product
https://issues.apache.org/jira/browse/HIVE-29671	issue-tracking
https://github.com/apache/hive/commit/45049202df3…	patch
https://lists.apache.org/thread/6d56mk501fp4f8cb5…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache Hive	Affected: 2.1.0 , ≤ 4.2.0 (semver)	guessed

Credits

zhaokaifei

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:50:37.199246Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:50:58.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.hive:hive-serde",
          "product": "Apache Hive",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.2.0",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "zhaokaifei"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eServer-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\u003c/p\u003e\u003cp\u003eAttacker access requirements:\u003c/p\u003e\u003cul\u003e\u003cli\u003eNetwork access to HiveServer2 / Metastore: required (remote attacker model).\u003c/li\u003e\u003cli\u003eValid Hive authentication: required.\u003c/li\u003e\u003cli\u003eCREATE TABLE (or equivalent) privilege: required, so the attacker can set \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;in table properties.\u003c/li\u003e\u003cli\u003eSELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\u003c/li\u003e\u003cli\u003eWrite access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\u003c/li\u003e\u003cli\u003eAdmin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\u003c/li\u003e\u003cli\u003eExternal tables enabled: typically required in practice, and enabled by default in most deployments.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eDetection guidance:\u003c/p\u003e\u003cul\u003e\u003cli\u003eInspect metastore / Hive table metadata for Avro tables whose \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\u003c/li\u003e\u003cli\u003eReview HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of \u003ccode\u003eavro.schema.url\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eCorrelate CREATE TABLE / ALTER TABLE activity that sets \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\u003c/li\u003e\u003cli\u003eOn cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url\u00a0table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\n\n\nAttacker access requirements:\n\n  *  Network access to HiveServer2 / Metastore: required (remote attacker model).\n  *  Valid Hive authentication: required.\n  *  CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url\u00a0in table properties.\n  *  SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\n  *  Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\n  *  Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\n  *  External tables enabled: typically required in practice, and enabled by default in most deployments.\n\n\n\n\nDetection guidance:\n\n  *  Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url\u00a0uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\n  *  Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.\n  *  Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url\u00a0with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\n  *  On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T10:13:27.529Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/apache/hive"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://issues.apache.org/jira/browse/HIVE-29671"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05"
        }
      ],
      "source": {
        "defect": [
          "HIVE-29671"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-55976",
    "datePublished": "2026-08-25T10:13:27.529Z",
    "dateReserved": "2026-06-17T23:57:13.013Z",
    "dateUpdated": "2026-08-26T18:50:58.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55976",
      "date": "2026-08-26",
      "epss": "0.00285",
      "percentile": "0.20529"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55976\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-08-25T11:16:53.673\",\"lastModified\":\"2026-08-26T20:17:53.640\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url\u00a0table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\\n\\n\\n\\nAttacker access requirements:\\n\\n  *  Network access to HiveServer2 / Metastore: required (remote attacker model).\\n  *  Valid Hive authentication: required.\\n  *  CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url\u00a0in table properties.\\n  *  SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\\n  *  Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\\n  *  Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\\n  *  External tables enabled: typically required in practice, and enabled by default in most deployments.\\n\\n\\n\\n\\nDetection guidance:\\n\\n  *  Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url\u00a0uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\\n  *  Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.\\n  *  Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url\u00a0with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\\n  *  On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Hive\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"org.apache.hive:hive-serde\",\"versions\":[{\"version\":\"2.1.0\",\"lessThanOrEqual\":\"4.2.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-26T18:50:37.199246Z\",\"id\":\"CVE-2026-55976\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://github.com/apache/hive\",\"source\":\"security@apache.org\"},{\"url\":\"https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00\",\"source\":\"security@apache.org\"},{\"url\":\"https://issues.apache.org/jira/browse/HIVE-29671\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05\",\"source\":\"security@apache.org\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55976\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T18:50:37.199246Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T18:50:19.515Z\"}}], \"cna\": {\"title\": \"Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url\", \"source\": {\"defect\": [\"HIVE-29671\"], \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"zhaokaifei\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Hive\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.2.0\"}], \"packageName\": \"org.apache.hive:hive-serde\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/hive\", \"tags\": [\"product\"]}, {\"url\": \"https://issues.apache.org/jira/browse/HIVE-29671\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url\\u00a0table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\\n\\n\\n\\nAttacker access requirements:\\n\\n  *  Network access to HiveServer2 / Metastore: required (remote attacker model).\\n  *  Valid Hive authentication: required.\\n  *  CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url\\u00a0in table properties.\\n  *  SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\\n  *  Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\\n  *  Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\\n  *  External tables enabled: typically required in practice, and enabled by default in most deployments.\\n\\n\\n\\n\\nDetection guidance:\\n\\n  *  Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url\\u00a0uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\\n  *  Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.\\n  *  Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url\\u00a0with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\\n  *  On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eServer-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\u003c/p\u003e\u003cp\u003eAttacker access requirements:\u003c/p\u003e\u003cul\u003e\u003cli\u003eNetwork access to HiveServer2 / Metastore: required (remote attacker model).\u003c/li\u003e\u003cli\u003eValid Hive authentication: required.\u003c/li\u003e\u003cli\u003eCREATE TABLE (or equivalent) privilege: required, so the attacker can set \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;in table properties.\u003c/li\u003e\u003cli\u003eSELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\u003c/li\u003e\u003cli\u003eWrite access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\u003c/li\u003e\u003cli\u003eAdmin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\u003c/li\u003e\u003cli\u003eExternal tables enabled: typically required in practice, and enabled by default in most deployments.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eDetection guidance:\u003c/p\u003e\u003cul\u003e\u003cli\u003eInspect metastore / Hive table metadata for Avro tables whose \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\u003c/li\u003e\u003cli\u003eReview HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of \u003ccode\u003eavro.schema.url\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eCorrelate CREATE TABLE / ALTER TABLE activity that sets \u003ccode\u003eavro.schema.url\u003c/code\u003e\u0026nbsp;with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\u003c/li\u003e\u003cli\u003eOn cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918 Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-08-25T10:13:27.529Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55976\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T18:50:58.145Z\", \"dateReserved\": \"2026-06-17T23:57:13.013Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-08-25T10:13:27.529Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55976

Vulnerability from fkie_nvd - Published: 2026-08-25 11:16 - Updated: 2026-08-26 20:17

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security@apache.org	https://github.com/apache/hive
	security@apache.org	https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00
	security@apache.org	https://issues.apache.org/jira/browse/HIVE-29671
	security@apache.org	https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.hive:hive-serde",
          "product": "Apache Hive",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.2.0",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url\u00a0table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\n\n\nAttacker access requirements:\n\n  *  Network access to HiveServer2 / Metastore: required (remote attacker model).\n  *  Valid Hive authentication: required.\n  *  CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url\u00a0in table properties.\n  *  SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\n  *  Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\n  *  Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\n  *  External tables enabled: typically required in practice, and enabled by default in most deployments.\n\n\n\n\nDetection guidance:\n\n  *  Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url\u00a0uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\n  *  Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.\n  *  Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url\u00a0with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\n  *  On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity."
    }
  ],
  "id": "CVE-2026-55976",
  "lastModified": "2026-08-26T20:17:53.640",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55976",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T18:50:37.199246Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T11:16:53.673",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://github.com/apache/hive"
    },
    {
      "source": "security@apache.org",
      "url": "https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00"
    },
    {
      "source": "security@apache.org",
      "url": "https://issues.apache.org/jira/browse/HIVE-29671"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-GP8M-92X3-Q87G

Vulnerability from github – Published: 2026-08-25 12:31 – Updated: 2026-08-26 21:31

Details

Attacker access requirements:

Network access to HiveServer2 / Metastore: required (remote attacker model).
Valid Hive authentication: required.
CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url in table properties.
SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.
Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.
Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.
External tables enabled: typically required in practice, and enabled by default in most deployments.

Detection guidance:

Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.
Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.
Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.
On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-55976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T11:16:53Z",
    "severity": "CRITICAL"
  },
  "details": "Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url\u00a0table property on an Avro table that is subsequently queried. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity. Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\n\n\nAttacker access requirements:\n\n  *  Network access to HiveServer2 / Metastore: required (remote attacker model).\n  *  Valid Hive authentication: required.\n  *  CREATE TABLE (or equivalent) privilege: required, so the attacker can set avro.schema.url\u00a0in table properties.\n  *  SELECT privilege on the malicious table: not required for the creator, who can typically query their own table; any other user granted SELECT can also trigger the fetch.\n  *  Write access to the table LOCATION: not required; the attack uses the schema URL, not the data path.\n  *  Admin / superuser privileges: not required; an ordinary authenticated user with DDL rights is sufficient.\n  *  External tables enabled: typically required in practice, and enabled by default in most deployments.\n\n\n\n\nDetection guidance:\n\n  *  Inspect metastore / Hive table metadata for Avro tables whose avro.schema.url\u00a0uses unexpected schemes such as http, https, file, or ftp, or points at link-local / cloud metadata addresses (for example 169.254.169.254) or other internal hosts.\n  *  Review HiveServer2 and Metastore logs around CREATE/ALTER TABLE and queries against Avro tables for schema-resolution failures or outbound fetches of avro.schema.url.\n  *  Correlate CREATE TABLE / ALTER TABLE activity that sets avro.schema.url\u00a0with subsequent SELECT activity on the same table, especially when the URL target is unusual for schema distribution.\n  *  On cloud deployments, check instance / VPC flow logs and metadata service access logs for unexpected requests from Hive host identities shortly after Avro DDL or query activity.",
  "id": "GHSA-gp8m-92x3-q87g",
  "modified": "2026-08-26T21:31:33Z",
  "published": "2026-08-25T12:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55976"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/hive/commit/45049202df35cea382616624de3fe8d252aa2d00"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/hive"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/HIVE-29671"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55976 (GCVE-0-2026-55976)

FKIE_CVE-2026-55976

GHSA-GP8M-92X3-Q87G

Tags

Sightings

Nomenclature