CVE-2026-42809
Awaiting Analysis Awaiting Analysis - Queue
Temporary Storage Credential Issuance in Apache Polaris

Publication date: 2026-05-04

Last updated on: 2026-05-04

Assigner: Apache Software Foundation

Description
Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation becomes attacker- directed because the attacker can choose a reachable target location. In the confirmed variant, if the caller supplies a custom `location` during stage create and requests credential vending, Apache Polaris uses that location to construct delegated storage credentials immediately. The stage-create path itself neither runs the normal location validation nor the overlap checks before those credentials are issued. Closely related to that, the staged-create flow also accepts `write.data.path` / `write.metadata.path` in the request properties and feeds those location overrides into the same effective table location set used for credential vending. Those fields are secondary to the main custom-`location` exploit, but they are still attacker-influenced location inputs that should be validated before any credentials are issued.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-04
Generated
2026-05-07
AI Q&A
2026-05-05
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache polaris *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

This vulnerability allows an attacker to obtain broad temporary storage credentials before the effective table location is validated or reserved, potentially granting unauthorized access to sensitive data.

Such unauthorized access to data could lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls on data access and protection of personal and sensitive information.

Because the attacker can influence the scope of accessible data, this flaw undermines the principle of least privilege and could result in non-compliance with these regulations.


Can you explain this vulnerability to me?

This vulnerability in Apache Polaris involves the issuance of broad temporary storage credentials during staged table creation before the table location has been properly validated or reserved.

The temporary credentials are intended to limit access to specific table data and metadata, but due to insufficient validation, an attacker can supply a custom location and cause Apache Polaris to issue credentials scoped to that attacker-chosen location.

The vulnerability arises because the stage-create process does not perform normal location validation or overlap checks before issuing delegated storage credentials, allowing attackers to influence the scope of these credentials.

Additionally, attacker-controlled properties like write.data.path and write.metadata.path can also influence the effective table location used for credential vending, further expanding the attack surface.


How can this vulnerability impact me? :

This vulnerability can allow an attacker to obtain temporary storage credentials with broader access than intended.

Because the attacker can specify the location for which credentials are issued, they may gain unauthorized access to data and metadata in storage locations they should not be able to reach.

This can lead to data exposure, unauthorized data modification, or other malicious actions within the storage system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart