What is GHSA-3mmv-f538-2fpw?

GHSA-3mmv-f538-2fpw is a security advisory published by GitHub Security Advisories with unknown severity. Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2...

Which CVE IDs does GHSA-3mmv-f538-2fpw cover?

GHSA-3mmv-f538-2fpw covers the following CVE IDs: CVE-2026-56207. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-3mmv-f538-2fpwunknown

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-56207 →

📋 Description

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user.

This issue affects Apache Impala: >=4.0.0.

Users are recommended to upgrade to version 4.5.2, which fixes this issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-56207
https://lists.apache.org/thread/20cov78py0zqzx7dyq39ktythkwn91zs
http://www.openwall.com/lists/oss-security/2026/09/08/22
https://github.com/advisories/GHSA-3mmv-f538-2fpw