CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability Creates Critical Data Risk

The National Vulnerability Database (NVD) has detailed CVE-2026-42810, a critical flaw in Apache Polaris that allows literal * characters in namespace and table names. This seemingly innocuous feature becomes a major security hole when Polaris generates temporary S3 access policies. Instead of treating * as a literal character, S3 IAM policy matching interprets it as a wildcard, leading to significant privilege escalation. This means temporary credentials issued for a specially crafted table can grant access to the storage paths of other tables.

NVD reports that private testing against Polaris 1.4.0 on both MinIO and AWS S3 confirmed this behavior. Credentials for crafted tables like f*.t1, f*.*, *.*, and foo.* could access other tables’ S3 locations. This includes reading sensitive Iceberg metadata JSON files, listing exact S3 table prefixes, and, critically, creating and deleting objects under another table’s S3 prefix when write delegation was enabled. This isn’t just a disclosure risk; it’s a full data integrity nightmare. The NVD highlights a least-privilege scenario where an attacker with minimal permissions to create a wildcard table could still gain unauthorized read/write access to unrelated tables.

This vulnerability, with a CVSS score of 9.9 (CRITICAL), underscores a fundamental misconfiguration in how Polaris translates user-supplied input into security policies. The issue stems from improper neutralization of special elements (CWE-116) and improper input validation (CWE-20). For defenders, this means assuming that any Polaris deployment handling S3 data is at risk until patched. The attacker’s calculus is simple: exploit a system’s trust in its own policy generation to bypass intended access controls and gain broad, unauthorized access to data.