CVE-2026-49845

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue. Details about the issue: Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.

• CWE-94

• https://github.com/apache/hiveProduct
• https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288ePatch
• https://issues.apache.org/jira/browse/HIVE-29622Vendor Advisory
• https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05Mailing List, Vendor Advisory

Published

Aug 25, 2026

Last Modified

Aug 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4984The Twilio integration webhook handler accepts any POST requ…8.2
• CVE-2026-49840FreeSWITCH is a Software Defined Telecom Stack enabling the …9.1
• CVE-2026-49841FreeSWITCH is a Software Defined Telecom Stack enabling the …9.8
• CVE-2026-49842FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-49843FreeSWITCH is a Software Defined Telecom Stack enabling the …5.3
• CVE-2026-49844Improper encoding of non-finite floating-point values during…5.9
• CVE-2026-49846libks provides foundational support for signalwire C product…7.5
• CVE-2026-49847FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-49848FreeSWITCH is a Software Defined Telecom Stack enabling the …4.3
• CVE-2026-49849xShop is an open-source shop developed in Laravel. An Unrest…9.1
• CVE-2026-4985A vulnerability was identified in dloebl CGIF up to 0.5.2. T…5.3
• CVE-2026-49850InvoicePlane is a self-hosted open source application for ma…7.5