CVE-2026-42812

/// Technical description

In Apache Iceberg, the table's metadata files are control files: they tell readers

which data files belong to the table and which table version to read.

`write.metadata.path` is an optional table property that tells Polaris

where to

write those metadata files.

For a table already registered in a

Polaris-managed

catalog, changing only that property through an `ALTER TABLE`-style settings

change (not a row-level `INSERT`, `SELECT`, `UPDATE`, or `DELETE`) bypasses

the commit-time branch that is supposed to revalidate storage locations.

The full persisted / credential-vending variant requires the affected

catalog

to have `polaris.config.allow.unstructured.table.location=true`, with

`allowedLocations` broad enough to include the attacker-chosen target.

`allowedLocations` is the admin-configured allowlist of storage paths that

the

catalog is allowed to use. Public project materials suggest that this flag

is a

real supported compatibility / layout mode, not just a contrived lab-only

pr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References