Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-49845 |
| Alert Source | GitHub Advisory - critical vulnerability (CNA: Apache Software Foundation) |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-25 |
| Vendor | Apache Software Foundation |
| Product | Apache Hive (Hive Metastore) |
| Affected versions | all before 4.2.1 |
| Fixed version | 4.2.1 |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | No data (CVE published 2026-08-25) |
| CISA KEV | No |
| Ransomware | Not confirmed |
| Issue | HIVE-29622 |
Vulnerability Description
Hive Metastore (HMS) is the central metadata catalog of the Hadoop ecosystem — it holds table definitions, schemas, file locations and partition statistics. It is used not only by Hive itself but also by Spark, Trino, Presto, Impala and Flink. It is the single point through which knowledge of where and in what form an organisation’s data lives must pass.
Several Metastore RPCs resolve partitions by full partition name (PART_NAME), building the
SQL query directly from the client-supplied value. The direct SQL path — enabled by
default — does not parameterise that value, so a crafted partition name injects attacker
SQL into the query executed against the Metastore database.
An attacker with Metastore API access can therefore read, modify or otherwise affect partition
metadata they should not see — including statistics updates, TRUNCATE targets, and
file-metadata cache operations.
The impact is subtle, because it is not about exfiltrating rows from tables but about
tampering with the layer that says where the data is and how to read it. A changed
partition location can redirect reads and writes of analytical jobs, and a crafted TRUNCATE
target can destroy production data. In practice this is an integrity and availability attack
on the warehouse.
The vector requires authentication and access to the Metastore API. That bar is often lower than assumed: in many clusters HMS listens on the internal network without Kerberos, and “authenticated user” effectively means anyone who can submit a job to the cluster.
Required Actions
- Upgrade Apache Hive to 4.2.1 or later — the fix recommended by the ASF.
- Check who has network access to the Hive Metastore port (9083 by default). It should be reachable only from cluster nodes and service hosts, never from the general corporate network.
- Enable and verify Metastore authentication (Kerberos / SASL) and authorisation (Apache Ranger or storage-based authorization). Many deployments stop at HiveServer2 authentication and leave HMS open.
- Inventory Metastore clients. If Spark, Trino or Flink share the same HMS, upgrading Hive is not enough — confirm that none of those engines bypasses the new validation through its own HMS client.
- Review Metastore database logs for unusual queries and changes to the
PARTITIONSandTBLStables — the simplest way to detect abuse attempts.
Who Is Affected?
Organisations running their own Hadoop / Apache Hive analytics platforms. In practice that means telecommunications, banking, insurance and large retail — sectors that built data warehouses on Hadoop (Cloudera, Hortonworks, in-house builds) and still operate them under newer query engines.
The key practical observation: Hive Metastore often outlives Hive itself. Organisations migrating to Spark, Trino or Databricks keep HMS as a shared metadata catalog, and the component then drops out of the patch cycle because “we don’t use Hive any more”. Those are exactly the installations most exposed.
If any HMS-based metadata catalog runs in your organisation, the inventory question is: which version, and who can connect to it.
Sources
- NVD - CVE-2026-49845
- Apache JIRA - HIVE-29622
- Apache Hive - security mailing list
- Apache Hive - repository
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
