EUVD-2026-53835
GHSA-62q9-5g2h-5gxp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:Clear
AC:H reflects deployment-specific preconditions (S3 credential vending enabled, out-of-bounds readable object) beyond attacker control; PR:L confirmed by required authenticated registration privilege; C:L only.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Apache Polaris did not consistently validate storage locations supplied during table and view registration.
An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations.
If the catalog's underlying credentials could read an object outside that boundary, this could disclose limited information from the object.
Polaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary.
This second condition did not itself cause Polaris to read the referenced external locations during registration.
The demonstrated impact is limited to confidentiality.
No unauthorized data modification or availability impact has been demonstrated.
The server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read.
Exploitation requires an authenticated principal with table- or view-registration privileges.
AnalysisAI
Apache Polaris incorrectly enforces storage location boundaries during Iceberg table and view registration, enabling an authenticated principal with registration privileges to cause the catalog service to read S3 objects outside the configured allowed storage perimeter. Exploitation depends on a deployment running S3 credential vending where the catalog's underlying credentials can access objects beyond the allowed boundary - a constrained but realistic enterprise configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation of the server-side read condition requires all of the following: (1) the Apache Polaris deployment must be configured with S3 credential vending enabled, (2) the catalog's underlying storage credentials must have read access to at least one S3 object outside the catalog's configured allowed storage locations, and (3) the attacker must be an authenticated principal with table- or view-registration privileges in that Polaris catalog. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L reflects network-reachable exploitation by a low-privileged authenticated user with limited confidentiality impact - but the vendor-supplied AT:N (no attack requirements) warrants scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Apache Polaris security advisory at https://lists.apache.org/thread/scd8p9wy8b9j3om5wohbotpfycnmmjl4 for the patched release version and upgrade instructions; an exact fix version was not specified in the available intelligence data, so the advisory is authoritative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today