CVE-2026-49845

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49845", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-01T21:24:47.973Z", "datePublished": "2026-08-25T10:13:49.998Z", "dateUpdated": "2026-11-03T22:13:26.174Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-04T12:55:21.876Z"}, "title": "Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths", "problemTypes": [{"descriptions": [{"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "cweId": "CWE-94", "type": "CWE"}]}], "source": {"defect": ["HIVE-29622"], "discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Hive", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.hive:hive-standalone-metastore", "versions": [{"status": "affected", "version": "4.0.0", "lessThanOrEqual": "4.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\nDetails about the issue:\nSeveral Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() \u2192 '...') instead of bind parameters.\u00a0A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true).\u00a0An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.</span><br><br><b>Details about the issue:</b><br><span>Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() \u2192 '...') instead of bind parameters.&nbsp;A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true).&nbsp;</span>An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table &amp; partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.<br>"}]}], "references": [{"url": "https://github.com/apache/hive", "tags": ["product"]}, {"url": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e", "tags": ["patch"]}, {"url": "https://issues.apache.org/jira/browse/HIVE-29622", "tags": ["issue-tracking"]}, {"url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Leon Johnson", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-49845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T03:56:14.451615Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:13:26.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-49845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T03:56:14.451615Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:40:35.937Z"}}], "cna": {"title": "Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths", "source": {"defect": ["HIVE-29622"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Leon Johnson"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "critical"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Hive", "versions": [{"status": "affected", "version": "4.0.0", "versionType": "semver", "lessThanOrEqual": "4.2.0"}], "packageName": "org.apache.hive:hive-standalone-metastore", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/hive", "tags": ["product"]}, {"url": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e", "tags": ["patch"]}, {"url": "https://issues.apache.org/jira/browse/HIVE-29622", "tags": ["issue-tracking"]}, {"url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\nDetails about the issue:\nSeveral Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() \u2192 '...') instead of bind parameters.\u00a0A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true).\u00a0An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.", "supportingMedia": [{"type": "text/html", "value": "<span>SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.</span><br><br><b>Details about the issue:</b><br><span>Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() \u2192 '...') instead of bind parameters.&nbsp;A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true).&nbsp;</span>An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table &amp; partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-04T12:55:21.876Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49845", "state": "PUBLISHED", "dateUpdated": "2026-11-03T22:13:26.174Z", "dateReserved": "2026-06-01T21:24:47.973Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-25T10:13:49.998Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.hive:hive-standalone-metastore", "product": "Apache Hive", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.2.0", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:hive:4.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "5EBBABEC-E6AB-4106-8445-80964A219DB5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.\n\nDetails about the issue:\nSeveral Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() \u2192 '...') instead of bind parameters.\u00a0A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true).\u00a0An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone."}, {"lang": "es", "value": "La inyecci\u00f3n SQL en la resoluci\u00f3n de nombres de partici\u00f3n SQL directa de Hive Metastore en Apache Hive anterior a 4.2.1 en todas las plataformas permite a usuarios autenticados con acceso a las API de Hive Metastore leer, modificar o afectar metadatos de partici\u00f3n no deseados (incluyendo actualizaciones de estad\u00edsticas, objetivos de truncamiento y operaciones de cach\u00e9 de metadatos de archivos) a trav\u00e9s de nombres de partici\u00f3n manipulados en solicitudes RPC de metastore cuando el SQL directo est\u00e1 habilitado (el valor predeterminado). Se recomienda a los usuarios actualizar a la versi\u00f3n 4.2.1, que corrige este problema.\n\nDetalles sobre el problema:\nVarias RPC de Hive Metastore resuelven particiones por nombre de partici\u00f3n completo (PART_NAME) a trav\u00e9s de ayudantes de SQL directo. En esas rutas, los nombres de partici\u00f3n proporcionados por el cliente se incrustan en SQL usando concatenaci\u00f3n de cadenas (DirectSqlUpdatePart.quoteString() ? '...') en lugar de par\u00e1metros de enlace. Un nombre de partici\u00f3n que contiene una comilla simple (y SQL manipulado) puede alterar la cl\u00e1usula WHERE generada de modo que las b\u00fasquedas destinadas a una partici\u00f3n coincidan con filas adicionales. Eso puede afectar lecturas, actualizaciones de estad\u00edsticas, objetivos de truncamiento, objetivos de cach\u00e9 de metadatos y operaciones relacionadas cuando metastore.try.direct.sql est\u00e1 habilitado (predeterminado: true). Un llamador autenticado o de confianza de red con la capacidad de invocar las API de nombres de partici\u00f3n de Hive Metastore contra una tabla objetivo (directamente o a trav\u00e9s de Hive/otros clientes), cuando el SQL directo est\u00e1 habilitado puede realizar este ataque. Adem\u00e1s, el impacto es principalmente dentro de la orientaci\u00f3n de tabla y partici\u00f3n (leer/actualizar/truncar/eliminar/almacenar en cach\u00e9 las particiones incorrectas en una tabla a la que pueden hacer referencia), no acceso arbitrario entre bases de datos a trav\u00e9s de este error solamente."}], "id": "CVE-2026-49845", "lastModified": "2026-11-03T23:17:45.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49845", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T03:56:14.451615Z", "version": "2.0.3"}}]}, "published": "2026-08-25T11:16:53.410", "references": [{"source": "security@apache.org", "tags": ["Product"], "url": "https://github.com/apache/hive"}, {"source": "security@apache.org", "tags": ["Patch"], "url": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://issues.apache.org/jira/browse/HIVE-29622"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.2.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Hive", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "hive", "vendor": "apache"}], "created": "2026-08-25T11:30:06.578687+00:00", "updated": "2026-08-25T21:45:03.469758+00:00", "vendors": ["apache", "apache$PRODUCT$hive"]}