Apache Hive 4.2.1 patches critical SAML bearer impersonation in HiveServer2

What happened

Apache has disclosed CVE-2026-53561, a critical authentication flaw in HiveServer2 that lets an attacker with nothing but network access to the HTTP port impersonate any Hive user. According to a write-up on dev.to, the advisory covers Apache Hive 4.0.0 through 4.2.0 plus later unreleased branches, and the fix is the 4.2.1 release that appeared on Apache's download page on 24 August 2026, a day before the CVE record was published.

The bug sits in the optional SAML 2.0 support Hive 4.x added for HiveServer2 over HTTP. When it is enabled, a JDBC or ODBC driver completes an identity-provider round trip and then presents a short-lived token as an Authorization: Bearer header on the /cliservice endpoint. HiveServer2 is meant to verify that token's signature and match the client identifier to stored relay state before opening a session. In the affected versions that validation could be bypassed: a forged Bearer token yielded an authenticated session under any username the attacker chose.

Apache's advisory states that no Hive credentials, no identity-provider login, and no knowledge of the server's signing secret are required. Reachability to the HTTP port is the sole prerequisite, and the dev.to write-up notes the attack also works through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HiveServer2.

Who is affected

The scope is narrower than the critical rating might suggest. Only deployments running HTTP transport with hive.server2.authentication set to SAML are exposed. Kerberos and LDAP, the common configurations, are not affected, and Apache explicitly excludes setups where Knox handles single sign-on while HiveServer2 itself authenticates with LDAP or Kerberos.

There is no CVSS score to triage against: Apache's record carries a textual severity of critical only, NVD had not published an analysis at the time of the write-up, and the CVE is not in CISA's exploited-vulnerability catalog. Andrew Rukin of Arenadata reported the bypass. The impact is impersonation rather than direct code execution — the attacker gains a session with whatever privileges the impersonated user holds through HiveServer2.

Inside the fix

The fix, HIVE-29653, changes ThriftHttpServlet to Base64-decode the bearer token before HiveSamlAuthTokenGenerator.parse runs, so the relay-state and client-identifier checks actually inspect the token contents instead of skipping validation. The signature comparison was also corrected so that invalid signatures are rejected. Unit tests added with the change cover a valid round trip, forged signatures, malformed token structure, and expiry. Apache classifies the issue as CWE-287, CWE-345 and CWE-305 — authentication weaknesses, not a memory-safety bug.

Two more fixes ride the same release

The dev.to write-up points out that 4.2.1 also closes two other security bugs, which makes the upgrade worthwhile even for Kerberos and LDAP deployments.

CVE-2026-49845 (HIVE-29622) is a SQL injection in the Hive Metastore's direct-SQL partition-name resolution, rated critical by Apache and reported by Leon Johnson. Direct SQL is enabled by default, the affected package is org.apache.hive:hive-standalone-metastore 4.0.0 through 4.2.0, and the impact covers wrong-partition reads, stats, truncate, drop and cache operations on a table the caller can already reference. Version 4.2.1 moves those lookups to bind parameters.

CVE-2026-55976 (HIVE-29671) is server-side request forgery in Avro SerDe schema resolution via the avro.schema.url table property, rated important and reported by zhaokaifei. It reaches much further back, affecting Hive 2.1.0 through 4.2.0. An authenticated attacker with CREATE TABLE rights who sets the property and queries the table can make Hive fetch an attacker-controlled URL as the Hive process identity, reaching cloud instance metadata endpoints, internal services or local files. Version 4.2.1 validates the URL scheme and host and disables remote HTTP schema fetches by default.

What operators should do

Confirm the running version with hive --version, then upgrade to Apache Hive 4.2.1 from the official downloads page rather than assuming a distribution package already carries the fix. Check hive-site.xml for hive.server2.authentication and hive.server2.transport.mode: if the answers are SAML and HTTP, treat the bearer impersonation as urgent. Apache publishes no workaround for CVE-2026-53561, so patching is the only remedy.

Why it matters

HiveServer2 is often the front door to a data lake, and an unauthenticated way to become any user — potentially including admins — collapses all of the authorization work built on top of it. The absence of a CVSS vector is itself a risk: teams whose triage pipelines key off NVD scores may deprioritize a flaw Apache itself calls critical. The Knox detail cuts both ways, since operators may assume a proxy in front of HiveServer2 provides protection when the attack specifically traverses that pattern. Finally, the two sibling CVEs widen the exposure well beyond SAML deployments: the Avro SSRF reaches back to Hive 2.1.0, and the Metastore injection lives on a default-enabled code path.