Polaris
Monthly
Apache Polaris incorrectly enforces storage location boundaries during Iceberg table and view registration, enabling an authenticated principal with registration privileges to cause the catalog service to read S3 objects outside the configured allowed storage perimeter. Exploitation depends on a deployment running S3 credential vending where the catalog's underlying credentials can access objects beyond the allowed boundary - a constrained but realistic enterprise configuration. The demonstrated impact is limited to partial confidentiality disclosure of out-of-bounds objects; no unauthorized write or availability impact has been demonstrated, and no public exploit or active exploitation has been identified at time of analysis.
Apache Polaris incorrectly enforces storage location boundaries during Iceberg table and view registration, enabling an authenticated principal with registration privileges to cause the catalog service to read S3 objects outside the configured allowed storage perimeter. Exploitation depends on a deployment running S3 credential vending where the catalog's underlying credentials can access objects beyond the allowed boundary - a constrained but realistic enterprise configuration. The demonstrated impact is limited to partial confidentiality disclosure of out-of-bounds objects; no unauthorized write or availability impact has been demonstrated, and no public exploit or active exploitation has been identified at time of analysis.