Vulnerability in org.apache.polaris:polaris-core (CVE-2026-42810)
Summary
Vulnerability in org.apache.polaris:polaris-core (CVE-2026-42810). Successful exploitation can lead to full system takeover. Exploitable via TABLE_CREATE. Mitigation: upgrade to 1.4.1 or later.
Original description
The description as published by the source.
Apache Polaris accepts literal * characters in namespace and table names. When it
later builds temporary S3 access policies for delegated table access, those
same characters appear to be reused unescaped in S3 IAM resource patterns
and
s3:prefix conditions.
In S3 IAM policy matching, * is treated as a wildcard rather than as
ordinary text. That means temporary credentials issued for one crafted table
can match the storage path of a different table.
In private testing against Polaris 1.4.0 using Polaris' AWS S3 temporary-
credential path on both MinIO and real AWS S3, credentials returned for
crafted tables such as f*.t1, f*.*, *.*, and foo.* could reach other
tables' S3 locations.
The confirmed behavior includes:
-
reading another table's metadata control file ([Iceberg metadata JSON]);
-
listing another table's exact S3 table prefix ([table prefix]);
-
and, when write delegation was returned for the crafted table, creating
and
deleting an object under another table's exact S3 table prefix.
A control case using ordinary different names did not allow the same
cross-table access.
A least-privilege AWS S3 variant was also confirmed in which the attacker
principal had no Polaris permissions on the victim table and only the
minimal permissions required to create and use a crafted wildcard table
(namespace-scoped TABLE_CREATE and TABLE_WRITE_DATA on *). In that
setup, direct Polaris access to foo.t1 remained forbidden, but the
attacker
could still crea…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-42810 has been found in org.apache.polaris:polaris-core.
Attackers can target a specific entry point like TABLE_CREATE over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 9.9/10.
What to do: upgrade org.apache.polaris:polaris-core to 1.4.1 or later.
If unsure, ask your IT team or search "org.apache.polaris:polaris-core CVE-2026-42810" on the vendor's site.
CVE-2026-42810 (org.apache.polaris:polaris-core) — CWE-20 / CVSS v3 9.9
Attack vector: remote (network-reachable) / no user interaction
Attack surface: TABLE_CREATE / TABLE_WRITE_DATA / foo.t1
Patched: 1.4.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-20) exists in org.apache.polaris:polaris-core. Attackers reach the vulnerable code path via TABLE_CREATE.
Check the vendor advisory for the affected versions of org.apache.polaris:polaris-core. Attack surface: TABLE_CREATE / TABLE_WRITE_DATA / foo.t1.
Severity: Critical (CVSS 9.9/10). Successful exploitation can lead to full system takeover.
Update to 1.4.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで org.apache.polaris:polaris-core を使っているサービスとバージョンを洗い出す。
-
2Apply patch patch
Upgrade org.apache.polaris:polaris-core to 1.4.1ステージング環境で 1.4.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory lists.apache.org
- advisory github.com
- package github.com
- web openwall.com
- web github.com
- web github.com