Data Management and Analytics

In Apache Hive versions before 4.2.1 a critical severity vulnerability CVE-2026-49845 was detected. This vulnerability allows authenticated users to read, modify, or affect unintended partition metadata. To address this issue, users should upgrade Apache Hive to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49845.

In Apache Hive versions 4.0.0 through 4.2.0 a high severity vulnerability CVE-2026-53561 was detected. This vulnerability allows an unauthenticated attacker to authenticate as an arbitrary user. To address this issue, users should upgrade Apache Hive to version 4.2.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53561.

In Apache Hive versions before 4.2.1 a critical severity vulnerability CVE-2026-55976 was detected. This vulnerability allows an authenticated remote attacker to perform Server-Side Request Forgery (SSRF) attacks. To address this issue, users should upgrade Apache Hive to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55976.

In Grafana versions prior to 12.4.0 a medium severity vulnerability CVE-2026-17033 was detected. This vulnerability allows an authenticated attacker to submit a malicious alert containing a controlled URL. To address this issue, users should upgrade Grafana to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-17033.

In Baserow version 2.3.3 a high severity vulnerability CVE-2026-19754 was detected. This vulnerability allows a low-privileged authenticated user to execute arbitrary database queries, leading to SQL Injection (SQLi) and potential privilege escalation. This occurs due to improper input validation in the index() formula function. A user with permissions to create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. When Baserow recalculates the formula field values, the injected payload is executed. Because the generated SQL runs through the application’s database connection, it executes with the full privileges of the Baserow PostgreSQL role rather than the restricted permissions of the authenticated user. To address this issue, users should upgrade Baserow to a patched version 2.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19754.

In Elasticsearch versions from 8.18.0 before 8.19.20, and from 9.0.0 before 9.4.5 a medium severity vulnerability CVE-2026-78605 was detected. This vulnerability allows a network attacker to obtain confidential HTTP responses intended for other authenticated users, leading to unauthorized information disclosure. This occurs due to an Inconsistent Interpretation of HTTP Requests, commonly known as HTTP Request Smuggling (CWE-444). Under specific proxy deployment configurations, an attacker can manipulate HTTP requests to desynchronize the connection between the frontend proxy and the backend Elasticsearch server, allowing them to intercept or view responses belonging to other users’ sessions (CAPEC-33). To address this issue, users should upgrade Elasticsearch to versions 8.19.20, 9.4.5, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-78605.

In SQLite in affected versions a medium severity vulnerability CVE-2025-41771 was detected. This vulnerability allows an authenticated attacker to perform a SQL injection. To address this issue, users should upgrade SQLite to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41771.

In Apache Airflow versions before 22.3.0 a medium severity vulnerability CVE-2026-68868 was detected. This vulnerability allows an attacker to resolve another team’s Connection or Variable, obtaining its credentials in full. To address this issue, users should upgrade Apache Airflow to version 22.3.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68868.

In Kibana versions up to 8.16.2.a medium severity vulnerability CVE-2026-78581 was detected. This vulnerability allows an authenticated attacker to access or modify AI Assistant conversations they do not own, leading to unauthorized data modification and potential information disclosure. This occurs due to an Authorization Bypass Through User-Controlled Key (CWE-639) flaw. By referencing another user’s AI Assistant conversation identifier, an attacker can bypass Access Control Lists (ACLs) and interact with that conversation (CAPEC-1). However, successful exploitation requires the attacker to obtain or guess this specific, hard-to-guess identifier. To address this issue, users should upgrade Kibana to a patched version Elastic Kibana versions 8.16.3 and 8.17.2.. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-78581.