CVE-2026-57866

Apache Impala versions 4.4.x and 4.5.x are vulnerable to a server-side request forgery (SSRF) that allows authenticated users with access to the `ai_generate_text()` function to exfiltrate sensitive secrets from configured credential providers. The impact includes potential exposure of confidential information, as users can retrieve secrets if they know the corresponding keys. Organizations using these Impala versions, particularly those with users who have elevated permissions, should prioritize addressing this vulnerability to mitigate risks of data leakage.