CVE-2026-42809

/// Technical description

Apache Polaris can issue broad temporary ("vended") storage credentials during

staged

table creation before the effective table location has been validated or

durably reserved.

Those temporary credentials are meant to limit the scope

of

accessible table data and metadata, but this scope limitation becomes

attacker-

directed because the attacker can choose a reachable target location.

In the confirmed variant, if the caller supplies a custom `location` during

stage create and requests credential vending, Apache Polaris uses that location to

construct delegated storage credentials immediately. The stage-create path

itself neither runs the normal location validation nor the overlap checks

before those credentials are issued.

Closely related to that, the staged-create flow also accepts

`write.data.path` / `write.metadata.path` in the request properties and

feeds

those location overrides into the same effective table location set used for

credential vending. Those fields are secondar

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References