A critical authentication bypass vulnerability in Apache Impala allows unauthenticated remote attackers to impersonate any user, leading to a total compromise of data and system integrity.

This vulnerability stems from improper verification of cryptographic signatures (CWE-347) within the SAML2 authentication process for the hs2-http interface. Because the system fails to validate the token signature in the final step, an unauthenticated attacker can alter the username in the token and successfully authenticate as any other user.

The ability for an unauthenticated user to impersonate any other account, including administrative accounts, poses a severe risk to organizational security. Successful exploitation grants the attacker full access to the data and functionality available to the impersonated user, which may result in unauthorized data exfiltration, unauthorized modification of records, and complete loss of system control. With a CVSS score of 9.8, this vulnerability is classified as critical due to its ease of exploitation and the potential for total impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade Apache Impala to version 4.5.2 or later immediately to apply the necessary cryptographic signature verification logic.

Proactive Monitoring: Review access logs for the hs2-http interface to identify suspicious authentication patterns or anomalies where users appear to be switching identities or accessing resources inconsistent with their expected roles.

Compensating Controls: If an immediate patch cannot be deployed, restrict network access to the hs2-http interface using network-level access control lists or a Web Application Firewall configured to inspect and validate SAML assertion traffic, although these are temporary measures and not a substitute for patching.

Public Exploit Available: No

Given the critical nature of this authentication bypass and the potential for total system compromise, organizations running affected versions of Apache Impala must prioritize this update above all other maintenance tasks. Administrators should verify their current versioning immediately and proceed with the upgrade to 4.5.2 to eliminate the risk of unauthorized impersonation.