Andrew Rukin

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.

**Name of the Vulnerable Software and Affected Versions** Apache Hive versions 4.0.0 through 4.2.0 **Description** Improper authentication occurs during SAML bearer-token validation in HiveServer2 on deployments using HTTP transport with `hive.server2.authentication=SAML`. An unauthenticated network attacker can authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session by sending a forged Authorization: Bearer token to the `/cliservice` HTTP endpoint. This exploit requires no Hive credentials, SAML Identity Provider (IdP) login, or knowledge of the server signing secret, requiring only network reachability to the HiveServer2 HTTP port. **Recommendations** Upgrade to version 4.2.1.

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.3.1 **Description** The environment-variable secrets backend incorrectly resolves team-scoped Connections or Variables from the wrong team's scope. This occurs because the security guard intended to prevent this behavior only executes when no team scope is provided and fails to match team names containing underscores. Consequently, the system performs an unconditional global read of the `AIRFLOW CONN <TEAM> <ID>` variable, regardless of the requesting team. In multi-team mode, an authenticated user can use the `POST /api/v2/connections/test` endpoint to resolve another team's Connection and authenticate outward using those credentials. Exploitation requires the `[core] multi team` setting to be enabled, `[core] test connection` to be set to `Enabled`, team-scoped secrets to be provisioned as environment variables in the API-server process, and knowledge of the encoded identifier. **Recommendations** Upgrade to apache-airflow 3.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** FreeIPA (affected versions not specified) **Description** An issue exists where the `trust-fetch-domains` command is restricted by a read-only permission on the trust object instead of a trust-administration permission. This allows an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh by providing an attacker-supplied server and credentials. This can lead to unauthorized modification of trusted-domain and ID-range identity data within the IPA LDAP directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Ranger versions prior to 2.9.0 **Description** Logs contain replayable JSON Web Tokens (JWT), which are compact, URL-safe means of representing claims to be transferred between two parties. **Recommendations** Upgrade to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** Apache Ranger versions prior to 2.9.0 **Description** The UnixAuth component lacks protection against brute-force attacks. UnixAuth is a method used for user authentication against Unix system accounts. **Recommendations** Upgrade to version 2.9.0. Avoid using UnixAuth in production deployments.

**Name of the Vulnerable Software and Affected Versions** Apache Ranger Client Code versions prior to 2.9.0 **Description** An issue exists in the client code where TLS hostname verification is not properly performed. TLS (Transport Layer Security) hostname verification is a process that ensures the server the client is connecting to is actually the server it claims to be by verifying the hostname in the certificate. **Recommendations** Upgrade to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** Apache Ranger versions prior to 2.9.0 **Description** An issue allows for privilege escalation through the manipulation of a URL parameter. **Recommendations** Upgrade to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** Apache Ranger versions prior to 2.9.0 **Description** Remote Code Execution is possible through JDBC URL Injection. This occurs when an application fails to properly sanitize the JDBC URL, allowing an attacker to inject malicious parameters that can lead to the execution of arbitrary code on the server. **Recommendations** Upgrade to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** Apache Ranger versions prior to 2.9.0 **Description** Remote Code Execution is possible through arbitrary class instantiation within the `plugin-schema-registry` component. Arbitrary class instantiation occurs when an application creates an instance of a class specified by user-supplied input, which can lead to the execution of unauthorized code. **Recommendations** Upgrade to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** Apache Ranger versions prior to 2.9.0 **Description** Authentication is missing in the Download APIs, which could allow unauthorized access to resources. **Recommendations** Upgrade to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** 389-ds-base (affected versions not specified) **Description** A flaw exists in the LDBM backend attribute encryption where a hardcoded static initialization vector is used for AES-CBC and 3DES-CBC operations. This allows an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.3.0 **Description** The REST API task-instance detail and list endpoints return a deferred task's trigger kwargs without masking. This allows any authenticated user with DAG-scoped task-instance read access to view sensitive information, such as provider API keys, in clear text while the task is deferred. **Recommendations** Upgrade to version 3.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** FreeIPA ipa-otpd daemon (affected versions not specified) **Description** Two off-by-one errors exist in the OAuth2 device authorization handler of the ipa-otpd daemon. These errors can lead to out-of-bounds memory access when the daemon processes an oversized response from a configured external OAuth2/OIDC Identity Provider (IdP). An attacker who controls the IdP endpoint or performs a man-in-the-middle attack on it can trigger the daemon to read or write one byte beyond the end of a fixed-size buffer. This issue requires FreeIPA to be configured with an external IdP and a user to start the OAuth2 device authorization flow. The primary impact is a denial of service affecting the ipa-otpd daemon. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-ftp versions prior to 3.15.1 **Description** The `FTPSHook.get conn()` function in the Apache Airflow FTP provider creates an `ftplib.FTP TLS` connection without calling `prot p()`. This results in the data channel being transmitted in cleartext, even though the control channel is TLS-protected. Consequently, deployments utilizing `FTPSHook` or `FTPSFileTransmitOperator` to transfer files over FTPS expose file contents and credentials-in-transit to network attackers capable of observing the data connection. **Recommendations** Update apache-airflow-providers-ftp to version 3.15.1 or later.