Originally published at HOL

CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation

TL;DR: HiveServer2's SAML HTTP path accepted a forged Authorization: Bearer token as a real session. An unauthenticated attacker who can reach /cliservice can impersonate any Hive user. This is not the Kerberos or LDAP default. It needs HTTP transport and hive.server2.authentication=SAML. Apache's CVE record rates it critical as a textual severity and publishes no CVSS vector. NVD has no analysis score yet. Not in CISA KEV. Upgrade Apache Hive to 4.2.1. The same release also closes a Metastore SQL injection and an Avro SerDe SSRF.

What happened

Hive 4.x added optional SAML 2.0 authentication for HiveServer2 over HTTP. After the identity-provider round trip, the JDBC or ODBC driver presents a short-lived token as Authorization: Bearer. HiveServer2 is supposed to validate that token and the client identifier before it opens a session.

On 2026-08-25 Apache published CVE-2026-53561 (CVE List datePublished 2026-08-25T10:12:53.804Z). In Apache Hive 4.0.0 through 4.2.0, and later unreleased branches, that validator could be bypassed. A forged Bearer token sent to the HiveServer2 HTTP /cliservice endpoint produced an authenticated session as an arbitrary Hive user. Apache's record says no Hive credentials, SAML IdP login, or knowledge of the server signing secret is required. Network reachability to the HTTP port is enough, including through a reverse proxy such as Apache Knox that forwards unauthenticated requests to HiveServer2.

Apache Hive 4.2.1 was listed on the Hive downloads page on 24 August 2026 as the bugfix that addresses this SAML bearer-token issue plus two other security bugs in the same train. Andrew Rukin (Arenadata) reported the SAML bypass.

This is impersonation, not remote code execution by itself. The attacker gets an HS2 session as the user they named, then whatever that user can run through HiveServer2.

Affected versions

Product: Apache Hive (Maven org.apache.hive:hive-service)
Affected: 4.0.0 through 4.2.0, and later unreleased branches. Apache's CNA lists 4.0.0 with lessThanOrEqual 4.2.0. That is the advisory range. HOL's package list for this CVE was incomplete (4.0.0 only).
Fixed: 4.2.1
CWE: CWE-287 (Improper Authentication), CWE-345 (Insufficient Verification of Data Authenticity), CWE-305 (Authentication Bypass by Primary Weakness). All three are in the Apache CVE record.
CVSS: none published. Apache's CNA metric is a textual severity of critical, not a CVSS vector. NVD totalResults is 0 at research time. HOL Guard's pack has no score to cite. Not listed in CISA KEV.
Preconditions: HiveServer2 HTTP transport and hive.server2.authentication=SAML. Not the Kerberos or LDAP default. Apache says deployments where Knox handles SSO and HiveServer2 itself uses LDAP or Kerberos (not native SAML mode) are not affected by this specific issue. Hive 4.x is not every Hive install.

Treat the two sibling issues on the same 4.2.1 train as one upgrade:

CVE-2026-49845 (HIVE-29622): SQL injection in Hive Metastore direct-SQL partition-name resolution. Apache's description says Apache Hive before 4.2.1. The CNA affected range for org.apache.hive:hive-standalone-metastore is 4.0.0 through 4.2.0. Authenticated (or network-trusted) callers of Metastore partition-name APIs. Direct SQL is enabled by default (metastore.try.direct.sql, default true). Impact is wrong-partition read, stats, truncate, drop, and cache operations on a table the caller can already reference, not arbitrary cross-database access via this bug alone. Apache textual severity critical. CWE-94 in the Apache record. Reported by Leon Johnson.
CVE-2026-55976 (HIVE-29671): SSRF in Avro SerDe schema resolution via avro.schema.url. Apache Hive from 2.1.0 through 4.2.0 (description: before 4.2.1). Authenticated attacker with CREATE TABLE (or equivalent) who can set the table property, then query the table. Hive fetches the attacker URL as the Hive process identity and can hit cloud instance metadata, internal services, or local files. Apache textual severity important. CWE-918. Reported by zhaokaifei.

How to fix

Upgrade Apache Hive to 4.2.1. Confirm the running version first:

hive --version

Install 4.2.1 from the Apache Hive downloads page. Use the 4.2.1 binaries Apache published. Do not assume a distro package already carries this CVE assignment.

Check whether you are on the SAML HTTP path. In hive-site.xml look at:

hive.server2.authentication
hive.server2.transport.mode

If authentication is SAML and the transport is HTTP, treat the bearer impersonation as in-scope and upgrade now. If HiveServer2 is Kerberos or LDAP, this specific CVE does not apply. Still take 4.2.1 for CVE-2026-49845 and CVE-2026-55976.

Apache's CVE record for CVE-2026-53561 publishes no workaround. Upgrade. For the Metastore sibling, the vulnerable code is the default-on direct SQL path; 4.2.1 switches those partition-name lookups to bind parameters. For the Avro sibling, 4.2.1 (HIVE-29671) validates avro.schema.url schemes and hosts and disables remote HTTP schema fetch by default.

Technical details

The SAML HTTP flow mints a short-lived callback token after the IdP posts a SAML assertion to HiveServer2. The driver then sends that token as Authorization: Bearer on /cliservice. HiveServer2 must parse the token, check the signature, and match the client identifier to the stored relay state before it opens a session.

HIVE-29653 (commit 6ca06ca1104ff7462363087a867d70d546134774) is the fix. ThriftHttpServlet now Base64-decodes the bearer token before HiveSamlAuthTokenGenerator.parse, so relay-state and client-identifier checks see the token contents instead of skipping validation. HiveSamlAuthTokenGenerator signature comparison was corrected so invalid signatures are rejected. The unit tests added in that change cover a valid round trip, forged signatures, malformed structure, and expiry. That is CWE-287 / CWE-345 / CWE-305, not RCE.

Apache published no CVSS. HOL's evidence pack has no score to cite either. NVD had not ingested the CVE at research time.

This article is the operator write-up: what broke, who is affected, and how to fix it. The HOL Guard evidence page is the source record for CVE-2026-53561.