CVE-2026-49845

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49845
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49845.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49845
Published
2026-08-25T10:13:49.998Z
Modified
2026-08-28T08:05:16.279167Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
Details

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.

Details about the issue: Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49845.json",
    "cwe_ids": [
        "CWE-94"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/hive

Affected ranges

Type
GIT
Repo
https://github.com/apache/hive
Events
Introduced
cb06ad72d609e51b6a3a38ccb120e34b4281067c
Fixed
ca64f08a8e43db9845b47d5fa2e96f7fdea7288e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:hive:4.2.0:*:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.2.0"
        },
        {
            "last_affected": "4.2.0"
        }
    ]
}

Affected versions

4.*
4.2.0

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-49845-1fb4bd3c",
        "target": {
            "function": "getPartitionInfo",
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/DirectSqlUpdatePart.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "197805796427408280537942415091632962806",
            "length": 1027.0
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-49845-4ec52c51",
        "target": {
            "function": "getPartitionsByNames",
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/MetaStoreDirectSql.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "229815867478338895843631922141626440039",
            "length": 1391.0
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-49845-99d10482",
        "target": {
            "function": "updatePartitionColumnStatistics",
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/DirectSqlUpdatePart.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "29075027202734609101897933114909022779",
            "length": 1555.0
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-49845-a5109709",
        "target": {
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/DirectSqlUpdatePart.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "144564796777429042559266876225982166559",
                "222850633105444178797649979118592133786",
                "195481543715905846649141078084286262404",
                "281966899046105406523255212330586677571",
                "149704437211302509590543695688330202061",
                "268194821422779767466867435365822032381",
                "72056013162212359294872776727303472470",
                "183308687613507362671157933667845623382",
                "53432896012019402748797873602835043112",
                "99348875437286012005884906664075165699",
                "263106967397175285074317285532686517939",
                "233287532610375003087202222951063351763",
                "57383912491165433011037290627864763974",
                "304408973759729755755839772639898635650",
                "205416378107652755671258272698792524104",
                "236804519751240303444879698979642912793",
                "124979994920766444888931845722163974132",
                "29199984560542386632928792605462842327",
                "27222702463526660336954437179872440205",
                "247405879922007334733120624646126561265",
                "64894923938998396898674519207979895002",
                "41178431209779810802348153261505704338",
                "199278012374450635149684642393062346629",
                "154913019439831376092587634612507322654",
                "173685444914716737048422300973906614729",
                "181722053968625551888355091497872932927",
                "267976372599096081040085728905295074106",
                "135883986634985502852619188005573421919",
                "56753288977200428868404470230699465948",
                "150881007207523350758783078724546996489",
                "235889137783333186242721616764736958023",
                "298019750417643012908925589045115808481",
                "150897216893515312932290943650784085740",
                "184365249519016831357656484973501494223",
                "108587633537507210242609878158511307392",
                "185162646334706530348340747551883292283",
                "7164491393348765759188049157645329696",
                "49371378273366314482294452771407929331",
                "137710732616652926436971048605117739209",
                "269564667282192548235747540393083841651",
                "333495460520388887080233621635519850921"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-49845-b276d6e4",
        "target": {
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/MetaStoreDirectSql.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "287380808575456379379872126582068078550",
                "194505313851004479946762675058753698641",
                "225684850385571832882216413572918571910",
                "308690669216092188616404359641925302699",
                "226170437413857832010223959410552411961",
                "304568092563868860939367133656224087718",
                "158612123100747291307638241588409580350",
                "179346372861845566167962740739226081674",
                "173709257043910604426737563861117064917",
                "165812251391387233536816932404494142937",
                "331366973966517971421935279093548332044",
                "68648155651059945336608312464044356233",
                "29002507973971099745095827786297095309",
                "24361770820674912622020543827879302287",
                "25569695506272235323551705306002330840",
                "89542713906519867405737228167065298209",
                "20179218637430936060354044621501840636"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-49845-cc79abfa",
        "target": {
            "function": "quoteString",
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/DirectSqlUpdatePart.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "334569538173000158784445562462529603056",
            "length": 61.0
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-49845-d8e5888f",
        "target": {
            "file": "standalone-metastore/metastore-server/src/test/java/org/apache/hadoop/hive/metastore/TestObjectStore.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "49832521400034376898135781065479800581",
                "331375945093199252478269017070284070620",
                "153467529938994485750128578695738257495",
                "35188712704095000385176509469632627148",
                "234283959259162405239192132011174788282",
                "228373896090962765504293117212536380657",
                "14301374102815978111233835644397874070",
                "102985883370004705845453358973192829964",
                "159043463638527261579612979260465907292",
                "215557215037248619836154784454940846402"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-49845-f2d23e96",
        "target": {
            "function": "run",
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/MetaStoreDirectSql.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "276045683088308125315147508553959389750",
            "length": 131.0
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-49845-f9d4a5d7",
        "target": {
            "function": "getPartitionsViaPartNames",
            "file": "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/directsql/MetaStoreDirectSql.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "199000425881885110829868156315399308721",
            "length": 455.0
        },
        "signature_version": "v1",
        "source": "https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288e",
        "signature_type": "Function"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49845.json"
vanir_signatures_modified 
"2026-08-28T08:05:16Z"