Security Flaw in Apache Polaris Allows Unauthorized Credential Vending

CVE-2026-42809

What is CVE-2026-42809?

Apache Polaris contains a vulnerability that allows attackers to bypass normal validations and issue temporary storage credentials without proper checks. When a custom location is supplied during staged table creation, the system immediately constructs delegated storage credentials based on that location, disregarding essential location validation and overlap checks. Additionally, fields like 'write.data.path' and 'write.metadata.path' can also be manipulated, further compromising the security of data accessibility. This flaw enables attackers to dictate the scope of accessible data, posing a significant risk to data integrity and storage security.

References