FKIE_CVE-2026-49845

Vulnerability from fkie_nvd - Published: 2026-08-25 11:16 - Updated: 2026-09-28 23:10
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue. Details about the issue: Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.
References
security@apache.orghttps://github.com/apache/hiveProduct
security@apache.orghttps://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288ePatch
security@apache.orghttps://issues.apache.org/jira/browse/HIVE-29622Vendor Advisory
security@apache.orghttps://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05Mailing List, Vendor Advisory
Impacted products
Vendor Product Version
apache hive 4.2.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.hive:hive-standalone-metastore",
          "product": "Apache Hive",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.2.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:hive:4.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EBBABEC-E6AB-4106-8445-80964A219DB5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\nDetails about the issue:\nSeveral Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() \u2192 \u0027...\u0027) instead of bind parameters.\u00a0A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true).\u00a0An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table \u0026 partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone."
    },
    {
      "lang": "es",
      "value": "La inyecci\u00f3n SQL en la resoluci\u00f3n de nombres de partici\u00f3n SQL directa de Hive Metastore en Apache Hive anterior a 4.2.1 en todas las plataformas permite a usuarios autenticados con acceso a las API de Hive Metastore leer, modificar o afectar metadatos de partici\u00f3n no deseados (incluyendo actualizaciones de estad\u00edsticas, objetivos de truncamiento y operaciones de cach\u00e9 de metadatos de archivos) a trav\u00e9s de nombres de partici\u00f3n manipulados en solicitudes RPC de metastore cuando el SQL directo est\u00e1 habilitado (el valor predeterminado). Se recomienda a los usuarios actualizar a la versi\u00f3n 4.2.1, que corrige este problema.\n\nDetalles sobre el problema:\nVarias RPC de Hive Metastore resuelven particiones por nombre de partici\u00f3n completo (PART_NAME) a trav\u00e9s de ayudantes de SQL directo. En esas rutas, los nombres de partici\u00f3n proporcionados por el cliente se incrustan en SQL usando concatenaci\u00f3n de cadenas (DirectSqlUpdatePart.quoteString() ? \u0027...\u0027) en lugar de par\u00e1metros de enlace. Un nombre de partici\u00f3n que contiene una comilla simple (y SQL manipulado) puede alterar la cl\u00e1usula WHERE generada de modo que las b\u00fasquedas destinadas a una partici\u00f3n coincidan con filas adicionales. Eso puede afectar lecturas, actualizaciones de estad\u00edsticas, objetivos de truncamiento, objetivos de cach\u00e9 de metadatos y operaciones relacionadas cuando metastore.try.direct.sql est\u00e1 habilitado (predeterminado: true). Un llamador autenticado o de confianza de red con la capacidad de invocar las API de nombres de partici\u00f3n de Hive Metastore contra una tabla objetivo (directamente o a trav\u00e9s de Hive/otros clientes), cuando el SQL directo est\u00e1 habilitado puede realizar este ataque. Adem\u00e1s, el impacto es principalmente dentro de la orientaci\u00f3n de tabla y partici\u00f3n (leer/actualizar/truncar/eliminar/almacenar en cach\u00e9 las particiones incorrectas en una tabla a la que pueden hacer referencia), no acceso arbitrario entre bases de datos a trav\u00e9s de este error solamente."
    }
  ],
  "id": "CVE-2026-49845",
  "lastModified": "2026-09-28T23:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49845",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T11:16:53.410",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/apache/hive"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://issues.apache.org/jira/browse/HIVE-29622"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.