Description

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-09T11:17:14.827Z",
  "pubdate": "2026-09-09T11:17:14.827Z",
  "executiveSummary": "A critical security vulnerability exists in Apache Impala’s hs2-http interface regarding the processing of SAML2 authentication assertions.\nThe vulnerability involves the improper validation of the Bearer token signature during the final stage of the SAML2 authentication handshake.\nBy failing to cryptographically verify the signature, the application becomes susceptible to assertion injection and identity spoofing attacks.\nAn unauthenticated or authenticated attacker can manipulate the username attribute within the SAML2 response to impersonate arbitrary users, including administrative accounts.\nThis flaw compromises the integrity of the authentication process, allowing unauthorized actors to bypass access controls and perform actions with elevated privileges within the Impala environment.\nThe vulnerability affects Apache Impala versions 4.0.0 and above, and requires immediate remediation to prevent unauthorized data access and potential system compromise.\nThe risk is categorized as high, as it allows for full identity masquerading within the hs2-http service interface.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation logic of the hs2-http interface’s SAML2 integration. Specifically, the system performs a multi-step authentication process, but fails to execute a mandatory cryptographic signature verification on the Bearer token returned in the final step of the SAML2 flow.\nIn a secure SAML2 implementation, the service provider (Impala) must validate the digital signature of the incoming assertion against the identity provider’s (IdP) public key to ensure that the identity information has not been tampered with in transit.\nBecause Impala neglects this validation step, the application accepts the claims provided in the SAML response as truthful without verifying their origin or integrity. An attacker can intercept a valid SAML exchange and modify the claims—specifically the user identity attributes—before the token is submitted to the Impala interface.\nThe attack flow follows these steps: 1) The attacker initiates an authentication request via the hs2-http interface. 2) Upon redirection to the IdP, the attacker authenticates legitimately to receive a valid SAML assertion. 3) The attacker intercepts the HTTP response containing the SAML assertion before it reaches the Impala server. 4) The attacker modifies the username or subject identifier within the SAML assertion to match a target user. 5) The attacker submits the crafted token to the Impala hs2-http endpoint. 6) The Impala service processes the assertion, trusts the modified username due to the lack of signature verification, and establishes a session associated with the impersonated user.\nThis lack of verification allows for complete authentication bypass and account takeover. The vulnerable component is specifically the hs2-http interface authentication handler. All Apache Impala versions from 4.0.0 onwards are susceptible to this flaw until the application logic is patched to enforce strict signature validation. The exploitation requires network access to the hs2-http interface but does not require prior knowledge of the target user's credentials, as the identity is forged at the application layer during the assertion processing phase.\nThe post-exploitation impact includes unauthorized data retrieval, modification of database state, and the potential for privilege escalation if the impersonated user possesses administrative or high-level resource access roles within the cluster."
}