CVE-2026-42811 - Vulnerability Analysis

Overview

Apache Polaris 1.4.0 contains a broken access control vulnerability caused by improper escaping of namespace or table identifiers in Credential Access Boundary CEL expressions, letting attackers obtain delegated GCS credentials with bucket-wide access, exploit requires crafted namespace or table identifiers.

Severity & Score

Impact

Attackers can obtain temporary credentials with bucket-wide access, allowing listing, reading, creating, and deleting objects beyond intended table scope.

Mitigation

Update to the latest version with proper escaping of namespace and table identifiers in CEL expressions.

References

• https://lists.apache.org/thread/hovn5hmkj9wj7v9cd8sn67svg03klgvg
• http://www.openwall.com/lists/oss-security/2026/05/02/12

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner