CVE-2026-42809
Severity CVSS v4.0:
CRITICAL
Type:
CWE-20
Input Validation
Publication date:
04/05/2026
Last modified:
05/05/2026
Description
Apache Polaris can issue broad temporary ("vended") storage credentials during<br />
staged<br />
table creation before the effective table location has been validated or<br />
durably reserved. <br />
Those temporary credentials are meant to limit the scope<br />
of<br />
accessible table data and metadata, but this scope limitation becomes<br />
attacker-<br />
directed because the attacker can choose a reachable target location.<br />
<br />
<br />
<br />
In the confirmed variant, if the caller supplies a custom `location` during<br />
stage create and requests credential vending, Apache Polaris uses that location to<br />
construct delegated storage credentials immediately. The stage-create path<br />
itself neither runs the normal location validation nor the overlap checks<br />
before those credentials are issued.<br />
<br />
<br />
<br />
Closely related to that, the staged-create flow also accepts<br />
`write.data.path` / `write.metadata.path` in the request properties and<br />
feeds<br />
those location overrides into the same effective table location set used for<br />
credential vending. Those fields are secondary to the main custom-`location`<br />
exploit, but they are still attacker-influenced location inputs that should<br />
be<br />
validated before any credentials are issued.
Impact
Base Score 4.0
9.40
Severity 4.0
CRITICAL
Base Score 3.x
9.90
Severity 3.x
CRITICAL