Fixed issues in Cloudera Runtime 7.1.9 SP2 CHF 6

Know more about the cumulative hotfix 6 for 7.1.9 SP2. This cumulative hotfix was released on October 20, 2026.

Following are the list of fixes that were shipped for CDP Private Cloud Base version 7.1.9-1.cdh7.1.9.p20600.83793403.

CDPD-123535: Recon service principal was not authorized to call Ozone Manager getDBUpdates

Previously, the configured Recon service principal was not authorized to call the getDBUpdates endpoint on the Ozone Manager (OM), which could prevent Recon from receiving necessary database updates. This issue is now resolved, and the Recon service principal is correctly allowed to perform this action.

Apache JIRA: HDDS-16530

CDPD-119796: Atlas saved search API allowed users to overwrite saved searches owned by other users

Previously, when you created a saved search by using the Atlas POST /api/atlas/v2/search/saved REST API, Atlas did not verify the owner of an existing saved search whose GUID was included in the request body. As a result, an authenticated user could overwrite the name, owner, and search parameters of a saved search that belonged to another user.

This issue is now fixed. If the request body contains the GUID of an existing saved search, Atlas verifies that the requesting user owns that saved search and rejects the request with an HTTP 400 error if the user is not the owner.

Apache JIRA: ATLAS-5372

CDPD-122836: SQL injection vulnerability in HiveMetaStore partition lookups

Previously, when "metastore.try.direct.sql" was enabled (the default), HiveMetaStore performed partition lookups without using prepared statements. An attacker could craft partition names containing SQL metacharacters to manipulate the WHERE clause and access partitions they should not be able to read or modify.

This issue is resolved by migrating partition lookup and update code paths to use prepared statements with bind p arameters, preventing user-supplied partition names from being interpreted as SQL code. This fixes a vulnerability affecting reads, statistics upda tes, truncate operations, and metadata cache operations.

Apache Jira: HIVE-29622

CDPD-123841: Table property to disable recursive file listing not honored during metadata loading

Previously, the table property impala.disable.recursive.listing was not respected during ini tial metadata loading. When enabled, queries would still return results from files in subdirectories, contrary to the intention that only files in the table's root directory should be included.

This issue is now resolved by ensuring the impala.disable.recursive.listing property is prop erly honored during initial metadata loading, not just during refreshes or HMS events, providing consistent behavior across all metadata loading sc enarios.

Apache Jira: IMPALA-13303

CDPD-107031: Limit file descriptors according to RPC when loading large Iceberg table metadata

Previously, loading metadata for Iceberg tables with very large numbers of data or delete files could cause the catalog service to return all file descriptors in a single getPartialCatalogObject RPC. Serializing that response in one call can exceed JVM limits and cause the catalog daemon to fail with an OutOfMemoryError error. Partial metadata fetch from IMPALA-11402 applied to legacy HDFS partitioned tables only and Iceberg’s flat file list could not be truncated at partition boundaries.

This issue is resolved by extending partial catalog fetch to Iceberg tables. The catalog service caps descriptors according to the response using catalog_partial_fetch_max_files (IMPALA-11402). The coordinator fetches remaining files in follow-up requests with an incremented offset until metadata is complete, and replans if the table changes between batches.

Apache Jira: IMPALA-14583

CDPD-123961: ZooKeeper quorum TLS in FIPS mode accepted peer certificates with mismatched hostnames

Previously, ZooKeeper quorum TLS in FIPS mode did not verify the peer's hostname, so it accepted certificates whose Subject Alternative Name (SAN) did not match the connected host. This issue is now resolved and the CVE-2026-59969 is fixed. ZooKeeper now enforces hostname verification for quorum connections in FIPS mode.

CDPD-123960: ZooKeeper deleteContainer opcode skipped ACL checks and allowed unauthorized znode deletion

Previously, ZooKeeper did not check ACLs or sessions for the internal deleteContainer opcode, so unauthenticated clients could delete any empty persistent znode. This issue is now reoslved and the CVE-2026-79993 is fixed. ZooKeeper now checks DELETE permissions for these requests.

CDPD-123959: ZooKeeper setWatches reconnect replay skipped ACL checks and exposed restricted znode paths

ZooKeeper did not check ACLs when it replayed watches after a client reconnected, which could expose the paths of ACL-restricted znodes. This issue is now reoslved and the CVE-2026-59739 is fixed. ZooKeeper now checks ACLs during watch replay.

There are no Common Vulnerabilities and Exposures (CVE) fixed in this CHF.