Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-49845: Apache Hive lets crafted partition names alter metadata
CVE-2026-49845 · published 2 months ago
Summary
In Apache Hive versions earlier than 4.2.1, the service that keeps track of table parts builds database commands by inserting the partition name a user provides. By adding a single quote and special text, a user can change the command so the system reads or changes information about the wrong piece of data. Update Hive to version 4.2.1, or disable the option that uses direct database commands, to prevent this.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache hive | <= 4.2.0 |
| apache | hive |
4.2.0 cpe:2.3:a:apache:hive:4.2.0:*:*:*:*:*:*:* |
Original advisory text
Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.
Details about the issue:
Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.
Details about the issue:
Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.
References
- https://github.com/apache/hive Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49845... Vendor Advisory
- https://issues.apache.org/jira/browse/HIVE-29622 Third Party Advisory
- https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05 Vendor Advisory
- https://repo.maven.apache.org/maven2 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-49845 Vendor Advisory
- https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-94Code Injection
Timeline
Published25 Aug 2026
Updated6 Nov 2026
First seen25 Aug 2026
Track software like this
Free during beta