[ CVE-2026-93684 · Published 7 Oct 2026 ]
Vulnerability in Apache Software Foundation Apache Impala
CVSS 5.4
EPSS <1%No fix listed yet
[ Description ]Official description
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.