Security readout for executives and security teams
Plain-English summary
Apache Hive can mishandle crafted partition names when processing Metastore requests. A caller with suitable Metastore access may cause an operation intended for one partition to affect others, potentially exposing metadata or disrupting data operations. The flaw is critical, but its practical reach is limited to tables and partitions the caller can reference.
Executive priority
Prioritize emergency assessment and rapid upgrade wherever vulnerable Metastore APIs are reachable by users or services. Potential consequences include unintended metadata disclosure, modification, truncation, and availability impact. Internet exposure is not required, but trusted internal callers may still present material risk. Accelerate response for shared data platforms and broadly accessible Metastore services.
Technical view
Before Apache Hive 4.2.1, several Hive Metastore RPC paths concatenate client-supplied partition names into direct SQL instead of using bind parameters. With direct SQL enabled, crafted names can alter WHERE-clause matching and affect partition reads, statistics, truncation, or metadata-cache operations. The supplied record identifies CWE-94, although the vulnerability is described as SQL injection.
Likely exposure
Exposure requires Hive before 4.2.1, Metastore direct SQL enabled, and an authenticated or network-trusted caller able to invoke relevant partition-name APIs. Direct SQL is enabled by default. The supplied evidence says this flaw alone primarily affects unintended partitions within referenceable tables, rather than enabling arbitrary cross-database access.
Exploitation context
The supplied sources do not report known active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation requires access to relevant Hive Metastore APIs and crafted partition names. No conclusion can be made from these sources about public proof-of-concept availability or observed attacks.
Researcher notes
Affected logic uses DirectSqlUpdatePart.quoteString() and string concatenation when resolving PART_NAME values. Relevant paths reportedly include reads, statistics updates, truncation targeting, and file-metadata cache operations. Scope and authorization should be tested defensively without assuming the CVSS vector’s PR:N value overrides the narrative requirement for an authenticated or network-trusted caller.
Mitigation direction
- Upgrade Apache Hive to version 4.2.1 or later.
- Restrict Hive Metastore API access to authorized, trusted clients.
- Review vendor guidance if upgrading cannot be completed immediately.
- Apply least-privilege controls to table and partition operations.
Validation and detection
- Inventory Hive and standalone Metastore versions across all environments.
- Confirm whether metastore.try.direct.sql is enabled; its default is true.
- Identify users and network clients able to invoke Metastore partition-name APIs.
- Review logs for unusual partition-name requests or unexpectedly broad partition operations.
- Confirm deployed packages contain the vendor fix associated with Hive 4.2.1.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-49845 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/apache/hiveCVE reference, apache · product
- https://github.com/apache/hive/commit/ca64f08a8e43db9845b47d5fa2e96f7fdea7288eCVE reference, apache · patch
- https://issues.apache.org/jira/browse/HIVE-29622CVE reference, apache · issue-tracking
- https://lists.apache.org/thread/6d56mk501fp4f8cb5wvrpj2jwd9knt05CVE reference, apache · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.