How severe is CVE-2018-11792?

CVE-2018-11792 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-11792 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (84th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-11792?

CVE-2018-11792 affects Apache Impala. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-11792?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2018-11792 published?

CVE-2018-11792 was published on 2018-10-24 and last updated on 2026-06-17.

CVE-2018-11792

CVE-2018-11792 is a critical-severity vulnerability in Apache Impala with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-732.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (84th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-732
Affected product: Apache Impala
Published: 2018-10-24
Last modified: 2026-06-17

Description

In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a table and ALL on a particular database allows a user to move the table to a database with ALL, which will automatically grant that user with ALL privilege on that table due to the privilege inherited from the database.

Frequently asked questions

What is CVE-2018-11792?: In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a table and ALL on a particular database allows a user to move the table to a database with ALL, which will automatically grant that user with ALL privilege on that table due to the privilege inherited from the database.
How severe is CVE-2018-11792?: CVE-2018-11792 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-11792 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (84th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-11792?: CVE-2018-11792 affects Apache Impala. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-11792?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2018-11792 published?: CVE-2018-11792 was published on 2018-10-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:impala:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Impala

CVE-2026-56207 — Critical (CVSS 9.8): Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface,…
CVE-2017-5640 — Critical (CVSS 9.8): It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0…
CVE-2026-57866 — High (CVSS 8.8): Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to…
CVE-2026-65181 — High (CVSS 8.1): Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to…
CVE-2021-28131 — High (CVSS 7.5): Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these…
CVE-2019-10084 — High (CVSS 7.5): In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can…

All CVEs affecting Apache Impala →

Other CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities

CVE-2026-92941 — Critical (CVSS 10.0): vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call…
CVE-2026-87988 — Critical (CVSS 10.0): An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through…
CVE-2026-9508 — Critical (CVSS 10.0): Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow…
CVE-2025-14988 — Critical (CVSS 10.0): A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain…
CVE-2025-69426 — Critical (CVSS 10.0): The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating…
CVE-2025-12004 — Critical (CVSS 10.0): Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown…

Browse all CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities →