- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://hive.apache.org
Products and areas 12
- Authentication across both services: Kerberos, LDAP, PAM and custom providers, along with impersonation and delegation-token handling
- Authorisation in every mode the project ships, including SQL standard authorisation and storage-based authorisation, and the integration points where an external authorizer is consulted
- Execution on the underlying engines, covering how a compiled plan reaches the cluster and what it is allowed to do there
- File format and serialisation handling: ORC, Parquet, Avro, text formats and every reader that opens a file the query planner pointed at
- HiveServer2 in full: the Thrift and HTTP transports, session handling, the JDBC and ODBC surface and the operations a client can invoke
- The HCatalog and WebHCat REST surface, and any other HTTP endpoint the distribution exposes
- The Hive Metastore Thrift API in full, including every metadata operation, the backing database access underneath it and the code that trusts a caller's identity
- The Metastore schema tools, the beeline client and the JDBC driver the project ships
- The project publishes a threat model naming its trust boundaries, and a SECURITY.md that routes reports through the ASF process to the project security list while ruling out public issues and pull requests. Those two documents define what the maintainers accept, and everything below sits inside them
- The query and UDF execution layer, including user-defined functions, custom serialisation handlers and the mechanism that loads a JAR named by a session
- The query compiler and optimizer, covering parsing, view expansion and how privileges are resolved against the objects a query touches
- The web interfaces exposed by the services and everything reachable from them
Out of scope (6)
- A cluster deliberately run without authentication or with impersonation disabled, which the threat model treats as a deployment decision
- Hadoop, Ranger, the underlying object stores and the relational database behind the Metastore, where Hive is only the client
- Recurring non-findings the project's threat model already records, and adversaries it places outside its trust boundaries
- Scanner and fuzzer output with no demonstrated crossing of a trust boundary
- Upstream dependency vulnerabilities, unless Hive's own use of the dependency makes them reachable
- Vendor distributions such as Cloudera CDP or a cloud provider's managed Hive, where the finding cannot be reproduced against the Apache release
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Report privately to the address on the policy page , the project's own security list.
-
Do not open public GitHub issues or pull requests for security reports.
-
Read THREAT_MODEL.md first.
-
Show the trust boundary your finding crosses or expect it to be closed
-
Say whether the finding is in HiveServer2, the Metastore or the execution layer, and whether it needs an authenticated SQL session.
-
hold the detail until the upstream release is announced
Not accepted
-
Recurring non-findings the project's threat model already records, and adversaries it places outside its trust boundaries
-
Upstream dependency vulnerabilities, unless Hive's own use of the dependency makes them reachable
-
Scanner and fuzzer output with no demonstrated crossing of a trust boundary
-
Scanner output, fuzzer crashes and AI-generated reports get measured against that threat model
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-97355 | Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-97356 | External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter o | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-82960 | Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because th | High 8.8 | 5 Nov 2026 |
| CVE-2026-83538 | Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no p | Medium 5.3 | 5 Nov 2026 |
| CVE-2026-83542 | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-84183 | Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CR | High 8.8 | 5 Nov 2026 |
| CVE-2026-84728 | Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostn | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-85627 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no | High 8.8 | 5 Nov 2026 |
| CVE-2026-92887 | Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of th | High 7.3 | 5 Nov 2026 |
| CVE-2026-82904 | Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by mu | High 7.5 | 5 Nov 2026 |
| CVE-2026-82907 | Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the | Critical 9.8 | 5 Nov 2026 |
| CVE-2026-82910 | Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute | High 8.8 | 5 Nov 2026 |
| CVE-2026-82912 | Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the | High 8.8 | 5 Nov 2026 |
| CVE-2026-82916 | Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassw | High 7.1 | 5 Nov 2026 |
| CVE-2026-82902 | Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supply | Medium 4.3 | 5 Nov 2026 |
| CVE-2026-114233 | Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShi | High 8.1 | 5 Nov 2026 |
| CVE-2026-114235 | Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114271 | Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other part | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114272 | Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommend | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-114277 | Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue. | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109129 | Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via the updateOrderPaymentPreference service, by supplying an orderPaymentPreferenceId belonging to a differ | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109837 | Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | Medium 5.4 | 5 Nov 2026 |
| CVE-2026-109856 | Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, creat | Medium 6.5 | 5 Nov 2026 |
| CVE-2026-109928 | Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative | High 7.4 | 5 Nov 2026 |
| CVE-2026-114229 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade | Medium 6.1 | 5 Nov 2026 |
| CVE-2026-59267 | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.8 | 4 Nov 2026 |
| CVE-2026-90631 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes | Low 3.3 | 4 Nov 2026 |
| CVE-2026-90632 | Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90634 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90624 | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90626 | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90627 | The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Medium 5.5 | 4 Nov 2026 |
| CVE-2026-90628 | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-90629 | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59264 | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.8 | 4 Nov 2026 |
| CVE-2026-59268 | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | High 7.3 | 4 Nov 2026 |
| CVE-2026-59263 | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | Low 1.9 | 4 Nov 2026 |
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to vers | Critical 9.8 | 30 Oct 2026 |
| CVE-2026-65874 | This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existin | High 8.8 | 30 Oct 2026 |
| CVE-2026-95628 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose f | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95629 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling tool in CLI mode, the default, and tells it where to write the converted document through the --output flag. When the CamelDoclingOutputFilePat | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-95663 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection | Medium 4.8 | 26 Oct 2026 |
| CVE-2026-95664 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the | Medium 5.4 | 26 Oct 2026 |
| CVE-2026-101259 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Intern | Medium 5.3 | 26 Oct 2026 |
| CVE-2026-111497 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie | Critical 9.2 | 22 Oct 2026 |
| CVE-2026-88900 | Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an Objec | High 8.8 | 19 Oct 2026 |
| CVE-2026-85313 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that let | Medium 4.3 | 19 Oct 2026 |
| CVE-2026-85314 | Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange w | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85315 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the status cause, which stays local to the server, the description is transmitted to th | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85316 | Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rather than by matching the path exactly. Any endpoint whose path merely begins with t | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85317 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token w | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85254 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by va | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85257 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client in the fault: CXF copies the message into the SOAP f | Medium 5.3 | 19 Oct 2026 |
| CVE-2026-85260 | Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the | Medium 5.5 | 19 Oct 2026 |
| CVE-2026-85296 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85312 | Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could | Medium 4.8 | 19 Oct 2026 |
| CVE-2026-85247 | Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on | Medium 5.9 | 19 Oct 2026 |
| CVE-2026-85249 | Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is attacker-controlled content: the party that supplies the file chooses the metadata ke | Medium 6.5 | 19 Oct 2026 |
| CVE-2026-85250 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default documen | High 7.5 | 19 Oct 2026 |
| CVE-2026-85251 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequ | High 7.5 | 19 Oct 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months Auth/access control 35 % Remote code execution 30 % Info disclosure 20 % Input validation 15 % Latest advisories Loading the feed Overview Apache Hive is the SQL warehouse layer over Hadoop and object storage, and the Hive Metastore is the catalog nearly every other engine reads. Spark, Trino, Impala, Flink and Iceberg deployments resolve tables through it, and it ships inside AWS EMR, Google Dataproc, Azure HDInsight and Cloudera CDP. Whoever controls the Metastore controls where all of those engines think the data lives. Four CVEs landed in the past year, two of them high and shared with Impala. Hive runs a dedicated security list and publishes a threat model, and the Apache Software Foundation states that as a volunteer organisation it has no bug bounty. sorona.xyz pays you directly on qualified, reproduced findings. In scope The project publishes a threat model naming its trust boundaries, and a SECURITY.md that routes reports through the ASF process to the project security list while ruling out public issues and pull requests. Those two documents define what the maintainers accept, and everything below sits inside them HiveServer2 in full: the Thrift and HTTP transports, session handling, the JDBC and ODBC surface and the operations a client can invoke The Hive Metastore Thrift API in full, including every metadata operation, the backing database access underneath it and the code that trusts a caller's identity Authentication across both services: Kerberos, LDAP, PAM and custom providers, along with impersonation and delegation-token handling Authorisation in every mode the project ships, including SQL standard authorisation and storage-based authorisation, and the integration points where an external authorizer is consulted The query compiler and optimizer, covering parsing, view expansion and how privileges are resolved against the objects a query touches The query and UDF execution layer, including user-defined functions, custom serialisation handlers and the mechanism that loads a JAR named by a session Execution on the underlying engines, covering how a compiled plan reaches the cluster and what it is allowed to do there File format and serialisation handling: ORC, Parquet, Avro, text formats and every reader that opens a file the query planner pointed at The HCatalog and WebHCat REST surface, and any other HTTP endpoint the distribution exposes The Metastore schema tools, the beeline client and the JDBC driver the project ships The web interfaces exposed by the services and everything reachable from them Out of scope Recurring non-findings the project's threat model already records, and adversaries it places outside its trust boundaries Hadoop, Ranger, the underlying object stores and the relational database behind the Metastore, where Hive is only the client A cluster deliberately run without authentication or with impersonation disabled, which the threat model treats as a deployment decision Vendor distributions such as Cloudera CDP or a cloud provider's managed Hive, where the finding cannot be reproduced against the Apache release Upstream dependency vulnerabilities, unless Hive's own use of the dependency makes them reachable Scanner and fuzzer output with no demonstrated crossing of a trust boundary Most-valued findings Anything in the Metastore that lets a caller read or change metadata it has no right to. The Metastore is the catalog for Spark, Trino, Impala, Flink and Iceberg as well as Hive, so a defect there redirects engines that never ran a line of Hive code Authorisation bypass at the HiveServer2 front door: a session reading a table, a column or a view the authorizer should have refused Any path from SQL to code execution on a cluster node, including UDF and serialisation-handler loading that pulls a JAR from a location the caller controls. This is the most direct route from analyst access to cluster compromise The class the recent high-severity pair CVE-2025-10702 and CVE-2025-10703 landed in. Both were shared with Impala, so defects in the shared metadata and authorisation path are worth double the attention Impersonation and delegation-token defects, where a service acts as a user it should not be able to become Arbitrary file read or write reached through table locations, external table definitions or a serialisation handler pointed at a path outside the warehouse Disclosure of the credentials the services hold for object storage and for the Metastore database Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , the project's own security list. Hive is one of the few ASF projects with a dedicated alias rather than only the foundation-wide address Do not open public GitHub issues or pull requests for security reports. The SECURITY.md rules that out explicitly Read THREAT_MODEL.md first. It names the trust boundaries, states which adversaries are in and out of scope, and lists the recurring non-findings the maintainers are tired of receiving Scanner output, fuzzer crashes and AI-generated reports get measured against that threat model. Show the trust boundary your finding crosses or expect it to be closed There is no money at any severity. The ASF runs no bug bounty as a foundation-wide position Say whether the finding is in HiveServer2, the Metastore or the execution layer, and whether it needs an authenticated SQL session. The Metastore is reachable from engines that are not Hive, so that answer changes the blast radius Disclosure Handled under the ASF process through the project's own security list: a private report, a fix developed under embargo, then a public advisory and a CVE alongside the release carrying it. Hive publishes through the ASF and NVD rather than as GitHub advisories, so do not expect a GHSA on the mirror. Distribution vendors backport Hive fixes on their own schedules, so hold the detail until the upstream release is announced. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability