PT-2026-36668 · Apache · Apache Polaris

Jean-Baptiste Onofré · Published 2026-05-02 · Updated 2026-05-13 · CVE-2026-42809

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Polaris (affected versions not specified)

Description Apache Polaris issues broad temporary storage credentials during staged table creation before validating or reserving the effective table location. This allows an attacker to direct the scope of accessible table data and metadata by choosing a reachable target location. Specifically, if a caller provides a custom location during stage create and requests credential vending, the system constructs delegated storage credentials immediately without performing normal location validation or overlap checks. Additionally, the staged-create flow accepts write.data.path and write.metadata.path in request properties, which act as location overrides and are used for credential vending without prior validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Missing Authorization

Weakness Enumeration

CWE-20

CWE-862

Related Identifiers

CVE-2026-42809

GHSA-8GGJ-J522-H5QF

Affected Products

Apache Polaris

References · 12

• https://osv.dev/vulnerability/GHSA-8ggj-j522-h5qf · Vendor Advisory
• https://lists.apache.org/thread/8tfsr8y7pgq6rdcvjx95hkcr47td671r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42809 · Security Note
• https://github.com/apache/polaris/commit/c98d610bc8f7ee237b272e01814391838dd6abf9 · Note
• https://github.com/apache/polaris · Note
• https://github.com/apache/polaris/releases/tag/apache-polaris-1.4.1 · Note
• https://twitter.com/infoflowcloud/status/2051362926485815548 · Twitter Post
• https://t.me/CVEtracker/52644 · Telegram Post
• https://twitter.com/oss_security/status/2050708838211334571 · Twitter Post
• https://twitter.com/CVEnew/status/2051361296252059826 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/02/10 · Note
• https://twitter.com/lyrie_ai/status/2054486676693479541 · Twitter Post