An unauthorized attacker can forge an HTTP Authorization: Bearer token and send it to the HiveServer2 /cliservice endpoint, exploiting an improper SAML bearer-token validation. This bypass lets the attacker authenticate as any Hive user without credentials or knowledge of the signing secret, enabling full access to data and query execution. The flaw is a classic authentication bypass (CWE‑287) compounded by improper input handling (CWE‑305) and missing verification of token integrity (CWE‑345).

Apache Hive 4.0.0 through 4.2.0, and any later unreleased branches that enable hive.server2.authentication=SAML in HTTP transport mode, are affected. The vulnerability exists only when SAML authentication is used over the HTTP transport (not in native LDAP/Kerberos mode). Deployments behind proxies such as Apache Knox that forward unauthenticated requests to HiveServer2 are vulnerable, while those that reject unauthenticated HTTP traffic or use different authentication mechanisms remain unaffected.

Because the exploitation does not require any credentials or prior knowledge of the server signing key, a network attacker with reachability to the HiveServer2 HTTP port can easily obtain an authenticated session as any user. The presence of a CVSS score of 7.4, combined with an EPSS score of < 1%, indicates a high severity with a low exploitation probability, yet the zero-authentication requirement and broad impact still denote a critical risk. The vulnerability is not listed in CISA’s KEV catalog; administrators should treat it as serious due to the potential for data exfiltration or privilege escalation.