Wildcard Vulnerability in Apache Polaris Affects AWS S3 Access Control

CVE-2026-42810

What is CVE-2026-42810?

Apache Polaris contains a vulnerability where it accepts literal * characters in namespace and table names, leading to improper handling of S3 IAM resource patterns and s3:prefix conditions. This flaw allows temporary credentials generated for one table to inadvertently enable access to another table’s S3 storage paths, resulting in unauthorized data access and modification. Specifically, crafted table names like f*.t1, f*.*, *.*, and foo.* can result in an attacker reading the metadata control files of other tables, listing their exact S3 prefixes, and even creating or deleting objects within unauthorized locations. This issue poses significant risks, as it compromises both the confidentiality and integrity of the data stored in S3.

References