CVE-2026-42809: Apache Polaris Critical Credential Vulnerability

The National Vulnerability Database (NVD) has detailed CVE-2026-42809, a critical vulnerability in Apache Polaris (CVSS 9.9). This flaw allows Polaris to issue overly broad, temporary storage credentials during staged table creation. These ‘vended’ credentials are intended to limit access to table data and metadata, but an attacker can manipulate this scope by specifying a custom, reachable target location.

Specifically, if a caller provides a custom location during a stage-create request and asks for credential vending, Apache Polaris immediately generates delegated storage credentials using that attacker-supplied location. The critical issue is that the stage-create path bypasses normal location validation and overlap checks before these powerful credentials are issued. This means an attacker dictates where those credentials point, granting them unauthorized access.

Further compounding the problem, the staged-create flow also accepts write.data.path and write.metadata.path properties in the request. These fields, while secondary to the primary custom-location exploit, similarly feed attacker-influenced location overrides into the credential vending process. Like the main vulnerability, these inputs are not properly validated before credentials are issued, creating additional avenues for exploitation.