{"id":"CVE-2026-97720","published":"2026-10-07T09:17:06.333","lastModified":"2026-10-07T19:17:45.470","description":"Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens.  Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.\nUsers are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-303"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/22","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw lies in the incorrect implementation of JWT/OAuth authentication in Apache Impala executors, allowing attackers to access resources served by the executor's webserver by bypassing token validation.","exploitability":"Exploitation is relatively easy as long as the webserver is configured to accept JWT/OAuth tokens, with no specific technical preconditions other than the presence of valid JWTs.","blast_radius":"If exploited, the impact could be significant, as attackers could gain unauthorized access to sensitive resources served by the Impala executors webserver.","remediation":"Upgrade to Apache Impala version 4.5.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","jwt","oauth"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:41:02.619Z"}}