CVE-2026-49845

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 4.2.1

Description An issue exists in the Hive Metastore where direct SQL partition-name resolution allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata. This occurs when client-supplied partition names are embedded into SQL using string concatenation via the DirectSqlUpdatePart.quoteString() function instead of using bind parameters. A crafted partition name containing a single quote can alter the generated WHERE clause, causing lookups to match additional rows. This affects operations such as statistics updates, truncation targets, and file-metadata cache operations when the metastore.try.direct.sql variable is enabled. The impact is limited to table and partition targeting within tables the user can already reference, rather than arbitrary cross-database access.

Recommendations Upgrade to version 4.2.1. As a temporary mitigation, disable the metastore.try.direct.sql variable.