CVE-2026-42809 - Vulnerability Analysis

Overview

Apache Polaris contains a broken access control vulnerability caused by issuing temporary storage credentials during staged table creation without validating or reserving the effective table location, letting attackers obtain broad storage access by supplying attacker-controlled locations, exploit requires ability to supply custom location parameters.

Severity & Score

Impact

Attackers can obtain broad temporary storage credentials, potentially accessing or modifying unauthorized table data and metadata.

Mitigation

Update to the latest version where location validation and overlap checks are enforced before credential vending.

References

• https://lists.apache.org/thread/8tfsr8y7pgq6rdcvjx95hkcr47td671r
• http://www.openwall.com/lists/oss-security/2026/05/02/10

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner