External risk intelligence

Apache Impala Executor JWT OAuth Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-97720

Apache Impala executors are typically deployed within internal, protected data analytics clusters rather than being exposed directly to the public internet. While they feature a web interface for monitoring and management, this service is generally restricted to internal network access and is not intended to be a public-facing endpoint in common real-world deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Apache Impala executors that could allow unauthorized access to resources. This issue stems from an improper implementation of authentication mechanisms, specifically related to JWT and OAuth tokens. While the impact depends on specific configurations, it highlights a need to ensure authentication controls are robustly applied. The main concern is confirming relevance and exposure to your environment.

Authentication tokens are not properly checked.
Protects data access and unauthorized resource exposure.
Verify if Impala executors are exposed externally.

Attack Path

How an attacker could exploit the issue

An attacker can gain access to resources served by an Impala executor's web server if it's configured to accept JWT or OAuth tokens. This is possible because the system incorrectly fails to validate the signatures of these tokens, allowing any valid-looking token to be accepted. If an attacker can send a crafted token to the web server, they may be able to access sensitive information or perform unauthorized actions.

Requires access to the executor's web server.
Triggered by sending an unvalidated JWT.
Risk of unauthorized resource access.

Live Threat

Current exploitation, exposure, and threat context

When an Impala executor's webserver is configured to accept JWT/OAuth tokens without proper signature validation, an attacker could potentially access resources served by that webserver. This vulnerability could affect system data and service behavior when the webserver is exposed and configured to use JWT/OAuth authentication.

System data and service behavior.
Unvalidated tokens allow unauthorized access.
Unauthorized resource access.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world deployments, the Apache Impala platform team or the data engineering team responsible for the analytics environment would likely own this issue. The first practical step is to identify all Impala executors, determine their reachability and business criticality, and then confirm the accountable owner for each instance to plan remediation.

Platform or data engineering teams own.
Verify Impala executor reachability.
Plan remediation by risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Impala and its executor role?

Apache Impala is a massively parallel processing SQL query engine used for high-performance data analytics on large datasets. Executors are the specific component instances that process these analytical queries and manage data retrieval. These executors often include a built-in web server interface used by engineers to monitor system health, view query performance, and manage internal service tasks.

What does CVE-2026-97720 mean for authentication?

This vulnerability, classified as CWE-303, involves an improper implementation of authentication. In this specific case, the Impala executor's web server fails to verify the cryptographic signatures of JWT or OAuth bearer tokens. Because the system does not confirm the legitimacy of the signature, it essentially treats any syntactically valid token as trusted, allowing unauthorized parties to bypass identity checks.

How is this authentication bypass triggered?

An attacker triggers the vulnerability by sending a crafted or arbitrary JWT to the affected web server component. The flaw is specifically tied to configurations where JWT or OAuth authentication is enabled. If an instance has authentication disabled for the web server, or uses a different mechanism entirely, this specific bypass vector does not apply.

Is my environment at risk from this CVE?

According to Halo Surface Signal, this vulnerability is considered unlikely to be exploited from the public internet in standard setups. Apache Impala executors are generally deployed within secured, internal data analytics clusters rather than on public-facing networks. You should prioritize assessment if your network architecture deviates from this standard by exposing these management interfaces to broader, untrusted segments.

When should I take action for CVE-2026-97720?

Begin by inventorying your environment to locate all running Impala executors and checking their web server configuration for JWT or OAuth settings. If these are active, prioritize upgrading to version 4.5.3, which corrects the signature validation logic. If an upgrade is not immediately feasible, temporarily disable JWT/OAuth authentication for the executor's web interface to neutralize the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.