CVE-2026-42809
Gravedad CVSS v4.0:
CRÍTICA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
04/05/2026
Última modificación:
05/05/2026
Descripción
*** Pendiente de traducción *** Apache Polaris can issue broad temporary ("vended") storage credentials during<br />
staged<br />
table creation before the effective table location has been validated or<br />
durably reserved. <br />
Those temporary credentials are meant to limit the scope<br />
of<br />
accessible table data and metadata, but this scope limitation becomes<br />
attacker-<br />
directed because the attacker can choose a reachable target location.<br />
<br />
<br />
<br />
In the confirmed variant, if the caller supplies a custom `location` during<br />
stage create and requests credential vending, Apache Polaris uses that location to<br />
construct delegated storage credentials immediately. The stage-create path<br />
itself neither runs the normal location validation nor the overlap checks<br />
before those credentials are issued.<br />
<br />
<br />
<br />
Closely related to that, the staged-create flow also accepts<br />
`write.data.path` / `write.metadata.path` in the request properties and<br />
feeds<br />
those location overrides into the same effective table location set used for<br />
credential vending. Those fields are secondary to the main custom-`location`<br />
exploit, but they are still attacker-influenced location inputs that should<br />
be<br />
validated before any credentials are issued.
Impacto
Puntuación base 4.0
9.40
Gravedad 4.0
CRÍTICA
Puntuación base 3.x
9.90
Gravedad 3.x
CRÍTICA