CVE-2026-42810: Apache Polaris S3 Credential Escalation via Wildcard Table Names

CVE-2026-42810: Apache Polaris Vulnerability in Handling of Character in Namespace and Table Names Vulnerability Overview Apache Polaris accepts the literal character in namespace and table names. When constructing temporary S3 access policies for delegated table access, these characters are reused as-is, appearing unescaped in the S3 IAM resource pattern and condition. In S3 IAM policy matching, is treated as a wildcard rather than plain text. This means that temporary credentials issued for a constructed table can match the storage path of another, different table. Impact Scope Affected Versions: Prior to Apache Polaris 1.4.1 Severity: Important Attack Scenarios: - Attackers can construct table names (e.g., , , , ) to access the S3 locations of other tables. - They can read the metadata control files (Iceberg metadata JSON) of other tables. - They can list the exact S3 table prefixes of other tables. - If write delegation is returned, they can create, list, read, and delete objects under the exact S3 table prefixes of other tables. Least Privilege Variant: Even if the attacker lacks Polaris permissions to access the victim table, possessing only and permissions allows them to obtain delegated S3 credentials by constructing table names, thereby performing read/write operations on . Data Leakage Risk: Metadata JSON files contain information about data file ownership, snapshot existence, and table version information. Unauthorized access constitutes a confidentiality issue. Remediation Upgrade to Apache Polaris 1.4.1 or later. Avoid using the literal character in namespace or table names. Ensure that special characters are properly escaped when generating S3 IAM policies. References https://polaris.apache.org https://www.cve.org/CVERecord?id=CVE-2026-42810

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-42810: Apache Polaris S3 Credential Escalation via Wildcard Table Names