CVE-2026-97720
Last modified
CVE-2026-97720 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Impala | >= 4.1.0, <= 4.5.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-97720?
How severe is CVE-2026-97720?
How do I fix CVE-2026-97720?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-97711Serialize JavaScript serializes JavaScript values to a super…2.3
- CVE-2026-97714CVE-2026-97714 is a is a vulnerability in the authentication…8.2
- CVE-2026-97715CVE-2026-97715 is a vulnerability in the client registration…7.1
- CVE-2026-97716CVE-2026-97716 is a vulnerability in the connection set up s…8.7
- CVE-2026-97717CVE-2026-97717 is a vulnerability in the proxy sub-system of…6
- CVE-2026-9772Unraid Web Server FileUpload Command Injection Remote Code E…8.8
- CVE-2026-97721A weakness has been identified in Sanluan PublicCMS up to 6.…2.7
- CVE-2026-97723madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site sc…5.4
- CVE-2026-97724A prototype pollution vulnerability in Software Mansion Reac…4.3
- CVE-2026-9773Unraid Web Server ToggleState Command Injection Remote Code …8.8
- CVE-2026-97730In Netgate pfSense Plus before 26.07 and pfSense CE before 2…8.5
- CVE-2026-97731MinIO through 7aac2a2 does not verify that every x-amz-* hea…7.1
Are you affected by CVE-2026-97720?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST