The vulnerability arises from direct string concatenation of client‑supplied partition names into Hive Metastore SQL when processing partition‑name APIs, exposing a code‑alteration flaw (CWE‑94). By injecting a partition name that contains a single quote and crafted SQL, an authenticated attacker can modify the WHERE clause, enabling the unauthorized reading, updating, or deleting of metadata for unintended partitions—including statistics updates, truncations, and cache operations. The attack scope is confined to partitions of tables that the attacker can reference, but the resulting data integrity and availability impact can be significant.

All versions of Apache Hive before 4.2.1 on any platform are vulnerable. The affected product is Apache Hive by the Apache Software Foundation, and the issue is resolved in Hive 4.2.1; no specific sub‑versions are listed.

The CVSS score is not reported, and the EPSS score is unavailable; the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated users with Hive Metastore API access, and the configuration flag that enables direct SQL (metastore.try.direct.sql) must be set to true, which is the default. Although the exploitation is limited to the scope of affected tables, manipulation of partition metadata can lead to data loss or incorrect query results, signifying a high risk that warrants immediate remediation.