CVE-2026-64640

CVE-2026-64640 — Apache Polaris: register におけるロケーション検証前の資格情報発行 CVE-2026-64640 の自己完結型・ワンコマンド再現スクリプトです。Apache Polaris の Iceberg REST register エンドポイントは、呼び出し元が指定したパスに対してクラウドストレージ資格情報を発行し、そのパスをカタログの allowedLocations と照合する前に サーバー側で読み取ります。 自カタログでテーブルを作成する権限しか持たないプリンシパルでも、Polaris...

polaris

Polaris は Kubernetes 向けのオープンソースポリシーエンジンです Polaris は Kubernetes 向けのオープンソースポリシーエンジンで、リソース設定の検証と修正を行います。30以上の組み込み構成ポリシーに加えて、JSON Schema を使用したカスタムポリシーの作成も可能です。コマンドラインまたはミューティング Webhook として実行すると、Polaris はポリシー基準に基づいて問題を自動的に修正できます。 Polaris は次の3つのモードで実行できます: ダッシュボードとして - ポリシーアズコードに基づいて Kubernetes...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fixed UBSAN array-index-out-of-bounds issues for Polaris and Tonga. For pptable structures that use flexible array sizes, use flexible arrays instead...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, podinfo, flux-helm-controller, go, victorialogs, flux-image-automation-controller, flux-source-controller, flux-operator, gotenberg, amazon-k8s-cni-fips, nova, flux-operator-fips, dkron, cluster-autoscaler-fips, aws-ebs-csi-driver-fips,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: terragrunt, pluto, grafana-rollout-operator, flux-image-reflector-controller, polaris, stakater-reloader, flux-image-automation-controller, metacontroller, steampipe, flux-source-controller, go, dkron, flux-notification-controller, nova, flux-helm-controller,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: terragrunt, pluto, grafana-rollout-operator, flux-image-reflector-controller, polaris, stakater-reloader, flux-image-automation-controller, metacontroller, steampipe, flux-source-controller, go, dkron, flux-notification-controller, nova, flux-helm-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: wire-go, cerbos, nri-haproxy, rclone, kubernetes-csi-external-health-monitor, kapp, portieris, kapp-controller, undock, zot, falcoctl, polaris, hubble, kubernetes-dashboard-api, nginx-prometheus-exporter, wal-g, k8sgateway, lazydocker, nuclei, helm-operator, nodetain...

CVE-2026-64640

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640

Apache Polaris is affected by a storage-location validation flaw during table/view registration. An authenticated user with table- or view-registration privileges could trigger Polaris to use the catalog’s storage credentials to read a caller-supplied Iceberg metadata file before confirming it li...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

EUVD-2026-53835

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-42812

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. write.metadata.path is an optional table property that tells Polaris where to write those metadata files. For a table already registered in a...

CVE-2026-42810

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

CVE-2026-42809

Apache Polaris can issue broad temporary "vended" storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation...

CVE-2026-42811

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials b...

GHSA-W76P-3CGP-QFCM Apache Polaris has an Improper Input Validation issue

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. write.metadata.path is an optional table property that tells Polaris where to write those metadata files. For a table already registered in a...

GHSA-FC3H-C6H7-R83J Apache Polaris has an Improper Input Validation issue

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials b...

GHSA-VXGG-MQX2-3W59 Apache Polaris has an Improper Input Validation Issue

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

Expression Language Injection

Overview org.apache.polaris:polaris-core is an a catalog for data lakes. It provides new levels of choice, flexibility and control over data, with full enterprise security and Apache Iceberg interoperability across a multitude of engines and infrastructure Affected versions of this package are...