CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation

Originally published at HOL

CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation

TL;DR: HiveServer2's SAML HTTP path accepted a forged Authorization: Bearer token as a real session. An unauthenticated attacker who can reach /cliservice can impersonate any Hive user. This is not the Kerberos or LDAP default. It needs HTTP transport and hive.server2.authentication=SAML. Apache's CVE record rates it critical as a textual severity and publishes no CVSS vector. NVD has no analysis score yet. Not in CISA KEV. Upgrade Apache Hive to 4.2.1. The same release also closes a Metastore SQL injection and an Avro SerDe SSRF.

What happened

Hive 4.x added optional SAML 2.0 authentication for HiveServer2 over HTTP. After the identity-provider round trip, the JDBC or ODBC driver presents a short-lived token as Authorization: Bearer. HiveServer2 is supposed to validate that token and the client identifier before it opens a session.