Impaired authorization around Impala Data Source tables allows an authenticated client who can upload files to external storage to create a table that triggers execution of arbitrary Java code. This flaw can lead to complete compromise of the Impala server, providing attackers with full code execution privileges on the host where Impala runs. The weakness is classified as CWE-913, indicating that authorization mechanisms were not properly enforced.

The affected product is Apache Impala, provided by the Apache Software Foundation. Versions 2.7 through 4.5 are vulnerable, including any 4.5 releases prior to the public patch in 4.5.2.

The vulnerability requires a client with valid privileges, so it is an authenticated threat. An attacker could exploit it by uploading a malicious file to remote storage and creating a Data Source table, causing Impala to load the file and run arbitrary Java code. While the CVSS score is not published, the impact of remote code execution is severe, and the endpoint is not listed in the CISA KEV catalog. The EPSS score is unavailable, but given the critical nature of remote code execution on a database service, the likelihood of exploitation should be treated as high.