CVE-2026-93684

Name of the Vulnerable Software and Affected Versions Apache Impala versions prior to 4.5.3

Description A stored Cross-Site Scripting (XSS) issue exists where an SQL user with only SELECT permissions can inject JavaScript into a table alias. This script executes in the browser of another user when they view the query plan through the Impala Web UI.

Recommendations Upgrade to version 4.5.3.