CVE-2026-97395 in Polaris
Summary
by MITRE • 09/29/2026
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.
In versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send storage requests to a host chosen by the table writer, using credentials scoped to the operation.
This can redirect server-side storage traffic and expose request authentication material to the chosen endpoint. Deployments are affected when table writers are not trusted to configure server-side storage endpoints.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability in Apache Polaris versions prior to 1.8.0 represents a critical misconfiguration flaw within the interaction between authenticated principals and the underlying Iceberg table metadata management system. This issue specifically targets users who possess permissions to create or update properties for Iceberg tables, allowing them to inject arbitrary FileIO client settings into the table metadata. Among these configurable parameters is the s3.endpoint setting, which dictates where storage requests are directed. In a secure architecture, server-side operations such as commits and purges should rely on catalog-level configurations that enforce consistent and trusted endpoints. However, in affected versions, Polaris prioritizes the endpoint defined within the table metadata over the catalog's default configuration if no explicit override is present. This design flaw effectively allows an authenticated user to dictate where the server sends its storage traffic during backend operations.
The operational impact of this vulnerability is severe, as it enables a form of request redirection that can lead to significant data exposure and potential compromise of infrastructure integrity. When Polaris performs server-side Iceberg operations like committing changes or purging old files, it constructs its FileIO client using the endpoint specified in the table metadata. Consequently, all storage requests generated by these administrative tasks are routed to a host chosen by the user who created or modified the table properties. This redirection exposes sensitive request authentication material, including access keys and tokens scoped to the operation, to an attacker-controlled endpoint. If the targeted endpoint is maliciously configured, it can intercept, log, or manipulate these credentials, potentially leading to unauthorized data access or further exploitation of the cloud storage infrastructure.
This vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), as well as CWE-20, Improvement in Input Validation and Representation, because it stems from insufficient validation of user-supplied configuration values that directly influence server-side behavior. From a threat modeling perspective using the MITRE ATT&CK framework, this flaw facilitates techniques associated with T1537, Communication Through Removable Media or External Cloud Services, by allowing attackers to redirect traffic to external endpoints they control. It also relates to T1048, Exfiltration Over Alternative Protocol, as sensitive authentication material can be exfiltrated through the redirected storage requests. The core issue is a lack of trust boundary enforcement between user-controlled metadata and server-side execution contexts.
To mitigate this vulnerability, organizations running Apache Polaris must upgrade immediately to version 1.8.0 or later, where these issues have been addressed by enforcing stricter validation on table properties that affect server-side operations. For deployments unable to upgrade instantly, administrators should ensure that the catalog storage configuration explicitly overrides any endpoint settings provided in table metadata. This ensures that even if a malicious user attempts to set an arbitrary s3.endpoint, the server will ignore it and use the trusted catalog-defined endpoint instead. Additionally, implementing strict role-based access control (RBAC) policies can limit which users have permission to modify Iceberg table properties, thereby reducing the attack surface for this specific misconfiguration. Regular auditing of table metadata configurations and monitoring for unusual outbound traffic patterns from Polaris servers can also aid in detecting potential exploitation attempts before significant damage occurs.