CVE-2026-64640
Received Received - Intake

Path Traversal in Apache Polaris

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations. If the catalog's underlying credentials could read an object outside that boundary, this could disclose limited information from the object. Polaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary. This second condition did not itself cause Polaris to read the referenced external locations during registration. The demonstrated impact is limited to confidentiality. No unauthorized data modification or availability impact has been demonstrated. The server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read. Exploitation requires an authenticated principal with table- or view-registration privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-64640
EUVD
EUVD-2026-53835

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache polaris *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Polaris had inconsistent validation of storage locations when registering tables or views. An authenticated user with registration privileges could trick Polaris into reading an Iceberg metadata file outside allowed storage locations using the catalog's credentials. This could lead to limited information disclosure if the credentials could access external objects.

Detection Guidance

Detecting this vulnerability requires checking Apache Polaris configurations for improper storage location validation during table or view registration. Review logs for unauthorized Iceberg metadata file reads or registration attempts referencing external storage locations. No specific commands are provided in the context.

Impact Analysis

If you use Apache Polaris with S3 credential vending, an attacker with table or view registration privileges could access limited data outside allowed storage locations. This requires exploitation of the registration process and does not allow unauthorized modification or deletion of data.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations must ensure proper access controls and storage validation to maintain compliance.

Mitigation Strategies
  • Upgrade Apache Polaris to a patched version that validates storage locations consistently.
  • Restrict table and view registration privileges to trusted authenticated principals only.
  • Audit existing table and view registrations for references to external storage locations.
  • Ensure S3 credential vending deployments enforce strict storage location boundaries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart