PT-2026-36671 · Apache · Apache Polaris

Jean-Baptiste Onofré · CVE-2026-42812 · Published 2026-05-02 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Polaris versions prior to 1.4.1

Description Changing the write.metadata.path table property via an ALTER TABLE settings change allows a user to bypass the commit-time branch intended to revalidate storage locations. This defect enables Apache Polaris to write table metadata to an attacker-chosen storage location before location validation occurs. If the catalog is configured with polaris.config.allow.unstructured.table.location=true and the allowedLocations allowlist is broad enough, this can lead to the persistence of the malicious path in the table state. Consequently, table-load and credential APIs may issue temporary cloud-storage credentials for the attacker-specified area, potentially exposing, modifying, or corrupting data and metadata within that storage scope, including other tables or bucket roots.

Recommendations Update to version 1.4.1. Restrict the ability to change table properties. Enforce strict storage allowlists within the allowedLocations configuration.

Exploit

Fix

RCE

Incorrect Permission

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-20

CWE-732

CWE-284

CWE-863

Related Identifiers

CVE-2026-42812

GHSA-W76P-3CGP-QFCM

Affected Products

Apache Polaris

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42812.json · Exploit
• https://lists.apache.org/thread/wxd2wj3p0smvrk84msv317wg5tp3jtw9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w76p-3cgp-qfcm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42812 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42812 · Vendor Advisory
• https://github.com/apache/polaris · Note
• https://github.com/apache/polaris/commit/d6bbcc386e61d08ba5df1f820d0724816d84427b · Note
• https://twitter.com/UpwindMDR/status/2051390988380156331 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054494623146357233 · Twitter Post
• https://twitter.com/oss_security/status/2050709698991566859 · Twitter Post
• https://t.me/CVEtracker/52647 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/02/13 · Note
• https://twitter.com/CVEnew/status/2051361297212600748 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051362944580030567 · Twitter Post