Metadata File Vulnerability in Apache Iceberg by Apache Software Foundation

CVE-2026-42812

What is CVE-2026-42812?

Apache Iceberg's vulnerable configuration allows a user to alter table settings to write metadata files to an arbitrary location, circumventing essential location checks. If certain conditions are met, this can lead to unauthorized access to sensitive data stored in the affected locations. By manipulating the write.metadata.path property, attackers can control where metadata is stored, potentially compromising data integrity and confidentiality, as the system may issue temporary storage credentials without rigorous validation. This flaw persists even when polaris.config.allow.unstructured.table.location is disabled, revealing core weaknesses in the table setting change validation process.

References