CVE-2026-42809 Apache Polaris: staged table creation could vend storage credentials for unvalidated locations
Attackers can obtain storage credentials for arbitrary locations during staged table creation, bypassing validation to access or modify unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42809?
CVE-2026-42809 is a critical missing authorization vulnerability in Apache Polaris, published on 4 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation becomes attacker- directed because the attacker can choose a reachable target location.
In the confirmed variant, if the caller supplies a custom `location` during stage create and requests credential vending, Apache Polaris uses that location to construct delegated storage credentials immediately. The stage-create path itself neither runs the normal location validation nor the overlap checks before those credentials are issued.
Closely related to that, the staged-create flow also accepts `write.data.path` / `write.metadata.path` in the request properties and feeds those location overrides into the same effective table location set used for credential vending. Those fields are secondary to the main custom-`location` exploit, but they are still attacker-influenced location inputs that should be validated before any credentials are issued.
Which versions are affected by CVE-2026-42809?
2 open source packages ship an affected version, including org.apache.polaris:polaris-runtime-service. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.polaris:polaris-runtime-service Maven | All versions | 1.4.1 |
org.apache.polaris:polaris-runtime-service Maven | All versions | 1.4.1 |
Products include Apache Polaris.
How do I fix CVE-2026-42809?
Upgrade org.apache.polaris:polaris-runtime-service to 1.4.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-42809 being exploited?
There is no known exploitation of CVE-2026-42809 in the wild and no public exploit code.
Other vulnerabilities in Apache Polaris
- CVE-2026-42810 Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names
- CVE-2026-42811 Apache Polaris has an Improper Input Validation issue
- CVE-2026-42812 Apache Polaris: No protection on `write.metadata.path`
- CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation
Sources
Also known as GHSA-8ggj-j522-h5qf.