A critical SQL injection vulnerability in Apache Hive allows authenticated users to manipulate partition metadata and disrupt critical database operations.

The vulnerability exists in the Hive Metastore direct SQL partition-name resolution, where client-supplied input is improperly sanitized via string concatenation. This allows an authenticated user to inject malicious SQL commands into partition-name parameters, affecting read, truncation, and statistics update operations.

Successful exploitation can lead to unauthorized modification of metadata, potential data integrity loss, and operational disruption of the Hive Metastore. Given the CVSS score of 9.8, this vulnerability poses a severe risk to data consistency and system availability for organizations relying on Hive for large-scale data processing.

Immediate Action: Upgrade to Apache Hive version 4.2.1 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review Metastore access logs for anomalous partition-name inputs, specifically looking for characters such as single quotes or unexpected SQL syntax within RPC requests.

Compensating Controls: If patching is delayed, ensure that the metastore.try.direct.sql configuration is reviewed, although upgrading remains the only definitive fix for this code-level flaw.

Public Exploit Available: No

This vulnerability represents a significant risk to data integrity within the Hive ecosystem. Administrators should prioritize the upgrade to version 4.2.1 to eliminate the injection vector and secure the Metastore against unauthorized metadata manipulation.