Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Hive

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-49845

    Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths

    SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics upda…

    Apache Software Foundation Apache Hive
  • Critical 9.1
    CVE-2026-55976

    Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url

    Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url …

    Apache Software Foundation Apache Hive
  • Critical 9.1
    CVE-2018-1282

    SQL Injection in hive-jdbc

    This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.

    Apache Software Foundation Apache Hive org.apache.hive:hive-jdbc Maven