Hive vulnerabilities

4 known vulnerabilities in Hive from Apache. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache Hive: Server-Side Request Forgery

  CVE-2026-55976Aug 25, 2026ApacheEPSS 1.04%

  Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url t

• 7.4 High severity

  Apache Hive: Improper Authentication

  CVE-2026-53561Aug 25, 2026Apache

  An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network

• 9.8 Critical severity

  Apache Hive: Improper Control of Generation of Code

  CVE-2026-49845Aug 25, 2026Apache

  SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updat

• 8.3 High severity

  Apache Hive: Deserialization of Untrusted Data

  CVE-2022-41137Dec 5, 2024ApacheEPSS 1.65%

  Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real