PT-2026-36670 · Apache · Apache Polaris

Jean-Baptiste Onofré · Published 2026-05-02 · Updated 2026-05-13 · CVE-2026-42811

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Polaris version 1.4.0

Description Apache Polaris fails to properly escape namespace and table identifiers when constructing Common Expression Language (CEL) strings for Google Cloud Storage (GCS) Credential Access Boundaries (CAB). This allows a crafted namespace or table name containing single quotes and URI-safe CEL fragments to break out of the intended quoted string and alter the CEL condition. Consequently, short-lived GCS credentials intended for a single table can be broadened to provide bucket-wide access within the configured bucket. This enables unauthorized actions, including listing, reading, creating, and deleting objects under other tables' prefixes or unrelated external prefixes in the same bucket.

Recommendations For version 1.4.0, restrict the use of crafted namespace or table identifiers until a fix is applied.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-917

Related Identifiers

CVE-2026-42811

GHSA-FC3H-C6H7-R83J

Affected Products

Apache Polaris

References · 13

• https://osv.dev/vulnerability/GHSA-fc3h-c6h7-r83j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42811 · Security Note
• https://lists.apache.org/thread/hovn5hmkj9wj7v9cd8sn67svg03klgvg · Vendor Advisory
• https://github.com/apache/polaris · Note
• https://github.com/apache/polaris/commit/f86ce44053e52f77331d212106a9ab6b83c5cace · Note
• https://twitter.com/CVEnew/status/2051361291088871482 · Twitter Post
• https://twitter.com/oss_security/status/2050709698991566859 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054494232203669815 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051362877051703553 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054494230496543199 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054494229590639017 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/02/12 · Note
• https://t.me/CVEtracker/52646 · Telegram Post