An unauthorized attacker can forge an HTTP Authorization: Bearer token and send it to the HiveServer2 /cliservice endpoint, exploiting an improper SAML bearer-token validation. This bypass lets the attacker authenticate as any Hive user without credentials or knowledge of the signing secret, enabling full access to data and query execution. The flaw is a classic authentication bypass (CWE‑287) compounded by improper input handling (CWE‑305) and missing verification of token integrity (CWE‑345).

Apache Hive 4.0.0 through 4.2.0, and any later unreleased branches that enable hive.server2.authentication=SAML in HTTP transport mode, are affected. The vulnerability exists only when SAML authentication is used over the HTTP transport (not in native LDAP/Kerberos mode). Deployments behind proxies such as Apache Knox that forward unauthenticated requests to HiveServer2 are vulnerable, while those that reject unauthenticated HTTP traffic or use different authentication mechanisms remain unaffected.

Because the exploitation does not require any credentials or prior knowledge of the server signing key, a network attacker with reachability to the HiveServer2 HTTP port can easily obtain an authenticated session as any user. The explicit absence of a CVSS score or EPSS metric leaves the exploitation probability uncertain, but the zero-authentication requirement and broad impact indicate a high severity posture. The vulnerability is not listed in CISA’s KEV catalog, however administrators should treat it as serious due to the potential for data exfiltration or privilege escalation.