The SAML path is a token-presentation protocol, and it only works if the server checks the token. After the identity-provider round trip, the JDBC or ODBC driver sends a short-lived token as `Authorization: Bearer`, and HiveServer2 is supposed to validate that token and the client identifier before it opens a session [6]. According to the HOL writeup republished on dev.to, that validator could be bypassed, so a token HiveServer2 never issued produced a session as whatever user the request named [2]. A bearer credential trusted because it is present is a session cookie with extra steps. Andrew Rukin of Arenadata reported the bypass [10]. Apache's record says the attack needs no Hive credential or IdP login, and it requires no knowledge of the server signing secret [c...ref removed if none]; a reverse proxy such as Knox forwarding unauthenticated requests still counts as reachability.
The severity field is where this gets operationally annoying. Apache's CNA metric is the word critical with no vector attached [7]. NVD had no analysis at research time, and the CVE is not in CISA KEV [7]. That is three empty inputs where a patch pipeline usually finds something to sort on [20]. So treat "critical" the way you would treat someone else's benchmark table: it describes a deployment where `hive.server2.transport.mode` is HTTP and `hive.server2.authentication` is SAML, and Apache's remediation note points at exactly those two lines in `hive-site.xml`, plus `hive --version` to establish what you are actually running [16]. Also worth saying plainly: the attacker gains impersonation of the named user, limited to whatever that user can run through HiveServer2 [9].
The Metastore bug on the same train has the opposite precondition profile. Direct SQL is on by default, `metastore.try.direct.sql` defaults to true [13], and the injection sits in direct-SQL partition-name resolution, which Apache also rates critical in text [12]. Per Apache the blast radius stays inside tables the caller can already reference, but that set includes truncate, drop and cache operations, not just wrong-partition reads [14]. The Avro SerDe SSRF is the long-tail item: affected from 2.1.0 through 4.2.0, which is two major lines further back than SAML support has existed [15][19], and it needs an authenticated user who can set `avro.schema.url` on a table and then query it [15].
One scheduling detail is worth noting for anyone reconciling change tickets. Apache listed 4.2.1 on the downloads page on 24 August 2026 [11] and the CVE record published on 25 August 2026 [1], so the artifact was available a day before the advisory naming it [18]. Feeds lag differently: the advisory range is 4.0.0 up to and including 4.2.0, while the HOL package list for this CVE carried only 4.0.0 [17]. Hive 4.x is also not every Hive install, since SAML for HiveServer2 arrived as an optional 4.x feature [21]. An inventory keyed to a vulnerability feed rather than to the running binary will under-count on precisely that boundary.
