Apache Polaris CVE-2026-97395

Exploitation requires (1) an authenticated Polaris principal holding permission to create or update Iceberg table properties, and (2) a deployment where the catalog storage configuration does NOT override FileIO endpoint settings such as s3.endpoint - so attacker-supplied table metadata is honored when Polaris constructs its server-side FileIO client. The vulnerability is triggered only when Polaris performs server-side operations (commits, purges) on the affected table. The vendor explicitly scopes impact to deployments where table writers are not trusted to configure server-side storage endpoints; environments where all table-property writers are trusted operators, or where the catalog config pins/overrides the endpoint, are not meaningfully exposed. Limiting factors: valid authentication plus a specific table-property privilege (PR:L), and a non-overriding storage configuration. Fixed in Apache Polaris 1.8.0.

This is a genuine but conditional server-side request forgery / credential-exposure issue (CWE-862, Missing Authorization) in Apache Polaris, not a drive-by critical. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N, 8.1) correctly reflects that exploitation is network-reachable and low-complexity, but requires an authenticated principal (PR:L) who already holds permission to create or update Iceberg table properties - so it is an insider/abuse-of-privilege problem rather than anonymous remote compromise. Multiple signals point AWAY from urgent, widespread risk: EPSS is only 0.19% (8th percentile), there is no KEV listing, no public exploit was identified, and CISA SSVC records Exploitation:none and Automatable:no. These align consistently - low probability, no observed exploitation, not mass-automatable. The one amplifying signal is SSVC Technical Impact:total, matching the dual C:H/I:H rating (leaked scoped storage credentials plus attacker-controlled redirection of server-side storage traffic). Net: a real priority only for deployments matching the stated condition (table writers not trusted to set server-side storage endpoints); for environments where all table-property writers are already trusted operators, real-world risk is materially lower than the 8.1 score suggests. The 'Authentication Bypass' tag conflicts with the facts - exploitation REQUIRES valid authentication plus a specific privilege, so treat that tag as inaccurate.

An authenticated Polaris principal who can create or update Iceberg table properties sets a FileIO setting such as s3.endpoint in table metadata to a host they control. When Polaris later performs a server-side operation (commit, purge) on that table and the catalog storage configuration does not override the endpoint, it builds its FileIO client against the attacker's host and sends storage requests - leaking the operation-scoped authentication credentials. No public exploit code was identified at time of analysis; low attack complexity means a single malicious property value suffices.