VulnSocial

CVE-2026-53561Disclosure(apache / hive)

LOWCVSS 7.4 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch apache hive systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix for this issue. Access / authorization required: No Hive credentials, SAML IdP login, or knowledge of the server signing secret is required. The attacker only needs network reachability to the HiveServer2 HTTP port (typically /cliservice), directly or through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HS2. The instance must have SAML authentication enabled in HTTP mode. Deployments where Knox handles SSO and HiveServer2 uses LDAP/Kerberos (not native SAML mode) are not affected by this specific issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-287CWE-305CWE-345

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • hive

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
apache
Products
hive

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-08-25: 2Patch / Workaround · 2026-08-25: 1Technical Details · 2026-08-25: 108-25
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-53561 An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments… https://www.cve.org/CVERecord?id=CVE-2026-53561

    Post summary

    A new authentication vulnerability (CVE‑2026‑53561) has been disclosed in Apache Hive's HiveServer2 SAML bearer‑token validation, affecting versions 4.0.0 through 4.2.0, with no current evidence of exploitation or mitigation solutions.

    000201.0K
    58.1K followersView on X
  • HOL@HashgraphOnline
    Patch

    Upgrade Apache Hive to 4.2.1. That build also closes two other Hive bugs in the same train. CVE-2026-53561. https://hol.org/blog/cve-2026-53561-apache-hive-hiveserver2-saml-bearer-impersonation

    Post summary

    The advisory recommends upgrading Apache Hive to version 4.2.1 to address CVE-2026-53561 and two related bugs.

    0000095
    18.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachehive---

Explore more

Back to dashboardapache CVEshive vulnerabilities