External risk intelligence

Apache Hive Metastore SQL Injection Affects Partition Metadata

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-49845

The vulnerability resides in the Hive Metastore API, which is a backend component typically deployed within internal, protected big data infrastructure. Access is generally restricted to authenticated internal services or trusted administrators rather than being directly exposed to the public internet.

Code Injection

Apache Hive

4.2.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Apache Hive Metastore allows authenticated users to manipulate partition metadata by injecting malicious code into partition names. This could lead to unintended modifications or deletions of data and statistics, impacting data integrity and availability within affected systems. The primary concern is confirming relevance and exposure within our environment.

Injected code in partition names alters data operations.
Impacts data integrity, statistics, and metadata.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker could target Apache Hive by sending specially crafted partition names through Hive Metastore APIs. If direct SQL is enabled, these names can manipulate SQL queries, potentially allowing the attacker to read, modify, or interfere with unintended partition metadata, including statistics, truncation targets, and cache operations.

Requires authenticated API access.
Crafted partition names trigger SQL injection.
Risk of unintended metadata modification.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, authenticated users with access to Hive Metastore APIs could affect unintended partition metadata, including statistics updates and cache operations, by crafting malicious partition names. This could lead to the modification or incorrect targeting of partition data within tables.

Table partition metadata and statistics.
Crafted partition names in API requests.
Incorrect data targeting or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Apache Hive Metastore affects backend data infrastructure, likely managed by platform or data engineering teams. The first practical step is for these teams to inventory their Hive Metastore deployments, confirm the "direct SQL" feature is enabled, and assess the reachability and criticality of affected instances before planning remediation, which may involve vendor coordination or scheduled maintenance.

Platform or data engineering teams own this.
Verify direct SQL and reachability.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Hive Metastore?

Apache Hive Metastore is a centralized service used in big data environments to store metadata for Hive tables. It tracks information about data structures—such as column types, partition locations, and table statistics—enabling query engines to understand and interact with the data stored in distributed file systems.

How does CVE-2026-49845 trigger a SQL injection?

This vulnerability belongs to the Improper Neutralization of Special Elements used in an SQL Command (CWE-94) class. It occurs because the software uses string concatenation instead of secure parameter binding when processing partition names. By including a single quote in a partition name, an authenticated caller can break out of the intended query structure to manipulate database operations.

Does any partition name trigger this vulnerability?

No. The vulnerability is triggered specifically when a crafted partition name contains characters like single quotes that alter the underlying SQL query's logic. It also requires the metastore.try.direct.sql setting to be enabled, which is the default configuration.

Is my instance affected by this vulnerability?

Halo Surface Signal indicates that this vulnerability typically resides in backend infrastructure and is unlikely to be directly reachable from the public internet. However, since the attack requires authenticated access to Hive Metastore APIs, you should prioritize reviewing any service or user that has authorization to interact with your Metastore endpoints.

What is the first step to address this issue?

You should verify if your organization uses Apache Hive versions prior to 4.2.1. Coordinate with your data engineering team to identify instances where the direct SQL feature is active. Once confirmed, plan to upgrade your Hive Metastore software to version 4.2.1, which resolves the insecure query construction.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.