Cloudera Docs

Fixed issues in Cloudera Runtime 7.1.9 SP2 CHF 6

Know more about the cumulative hotfix 6 for 7.1.9 SP2. This cumulative hotfix was released on October 20, 2026.

Following are the list of fixes that were shipped for CDP Private Cloud Base version 7.1.9-1.cdh7.1.9.p20600.83793403.

CDPD-123535: Recon service principal was not authorized to call Ozone Manager getDBUpdates
Previously, the configured Recon service principal was not authorized to call the getDBUpdates endpoint on the Ozone Manager (OM), which could prevent Recon from receiving necessary database updates. This issue is now resolved, and the Recon service principal is correctly allowed to perform this action.
Apache JIRA: HDDS-16530
CDPD-119796: Atlas saved search API allowed users to overwrite saved searches owned by other users
Previously, when you created a saved search by using the Atlas POST /api/atlas/v2/search/saved REST API, Atlas did not verify the owner of an existing saved search whose GUID was included in the request body. As a result, an authenticated user could overwrite the name, owner, and search parameters of a saved search that belonged to another user.
This issue is now fixed. If the request body contains the GUID of an existing saved search, Atlas verifies that the requesting user owns that saved search and rejects the request with an HTTP 400 error if the user is not the owner.
Apache JIRA: ATLAS-5372
CDPD-122836: SQL injection vulnerability in HiveMetaStore partition lookups
Previously, when "metastore.try.direct.sql" was enabled (the default), HiveMetaStore performed partition lookups without using prepared statements. An attacker could craft partition names containing SQL metacharacters to manipulate the WHERE clause and access partitions they should not be able to read or modify.
This issue is resolved by migrating partition lookup and update code paths to use prepared statements with bind p arameters, preventing user-supplied partition names from being interpreted as SQL code. This fixes a vulnerability affecting reads, statistics upda tes, truncate operations, and metadata cache operations.

Apache Jira: HIVE-29622

CDPD-123841: Table property to disable recursive file listing not honored during metadata loading
Previously, the table property impala.disable.recursive.listing was not respected during ini tial metadata loading. When enabled, queries would still return results from files in subdirectories, contrary to the intention that only files in the table's root directory should be included.
This issue is now resolved by ensuring the impala.disable.recursive.listing property is prop erly honored during initial metadata loading, not just during refreshes or HMS events, providing consistent behavior across all metadata loading sc enarios.

Apache Jira: IMPALA-13303

CDPD-107031: Limit file descriptors according to RPC when loading large Iceberg table metadata
Previously, loading metadata for Iceberg tables with very large numbers of data or delete files caused the catalog service to return all file descriptors in a single getPartialCatalogObject RPC. Serializing the response in one call exceeded the JVM limit and caused the catalog daemon to fail with an Out of Memory error.

This issue is resolved by extending partial catalog fetch to Iceberg tables. The catalog service caps descriptors according to the response using the catalog_partial_fetch_max_files flag. The coordinator fetches the remaining files in the subsequent requests with an incremented offset until the metadata is complete.

Apache Jira: IMPALA-14583

CDPD-123961: ZooKeeper quorum TLS in FIPS mode accepted peer certificates with mismatched hostnames
Previously, ZooKeeper quorum TLS in FIPS mode did not verify the peer's hostname, so it accepted certificates whose Subject Alternative Name (SAN) did not match the connected host. This issue is now resolved and the CVE-2026-59969 is fixed. ZooKeeper now enforces hostname verification for quorum connections in FIPS mode.
CDPD-123960: ZooKeeper deleteContainer opcode skipped ACL checks and allowed unauthorized znode deletion
Previously, ZooKeeper did not check ACLs or sessions for the internal deleteContainer opcode, so unauthenticated clients could delete any empty persistent znode. This issue is now resolved and the CVE-2026-79993 is fixed. ZooKeeper now checks DELETE permissions for these requests.
CDPD-123959: ZooKeeper setWatches reconnect replay skipped ACL checks and exposed restricted znode paths
ZooKeeper did not check ACLs when it replayed watches after a client reconnected, which could expose the paths of ACL-restricted znodes. This issue is now resolved and the CVE-2026-59739 is fixed. ZooKeeper now checks ACLs during watch replay.
Common Vulnerabilities and Exposures (CVE) fixed in this CHF are: