polaris

Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris：register 中在位置验证之前发放凭证 这是一个自包含、单命令的 CVE-2026-64640 复现工具：Apache Polaris 中的 Iceberg REST register 端点会为调用者提供的路径发放云存储凭证，并在根据目录的 allowedLocations 检查该路径之前 ，于服务端读取该路径。 一个仅拥有在其自身目录中创建表权限的主体，可以迫使 Polaris 使用该目录的存储凭证，去读取该目录本不允许接触的对象——另一个租户的前缀、另一个存储桶，以及存储主体能够访问到的任何内容。 | ---|---...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fixed UBSAN array-index-out-of-bounds issues for Polaris and Tonga. For pptable structures that use flexible array sizes, use flexible arrays instead...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: loki-fips, cluster-autoscaler-fips, victoriametrics, localstack, temporal-fips, nova, go, grafana-operator-fips, stakater-reloader, victoriametrics-cluster, amazon-k8s-cni-fips, aws-ebs-csi-driver-fips, terragrunt, aws-load-balancer-controller-fips, flux-fips,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: grafana-operator, flux-source-controller, victoriametrics, nova, steampipe, flux-image-reflector-controller, flux-image-automation-controller, terragrunt, polaris, pluto, flux-helm-controller, flux-notification-controller, victoriametrics-cluster, podinfo, dkron,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: grafana-operator, flux-source-controller, victoriametrics, nova, steampipe, flux-image-reflector-controller, flux-image-automation-controller, terragrunt, polaris, pluto, flux-helm-controller, flux-notification-controller, victoriametrics-cluster, podinfo, dkron,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: mongo-tools, dive, nri-redis, nova, undock, envconsul, steampipe, dex, regclient, nats-server-config-reloader, wgcf, flux, neuvector-sigstore-interface, kor, spire-controller-manager, k3s, opa, step-kms-plugin, wal-g, nri-consul, helm-operator, helm-push,...

CVE-2026-64640

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640

Apache Polaris is affected by a storage-location validation flaw during table/view registration. An authenticated user with table- or view-registration privileges could trigger Polaris to use the catalog’s storage credentials to read a caller-supplied Iceberg metadata file before confirming it li...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

EUVD-2026-53835

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-42812

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. write.metadata.path is an optional table property that tells Polaris where to write those metadata files. For a table already registered in a...

CVE-2026-42810

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

CVE-2026-42809

Apache Polaris can issue broad temporary "vended" storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation...

CVE-2026-42811

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials b...

GHSA-W76P-3CGP-QFCM Apache Polaris has an Improper Input Validation issue

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. write.metadata.path is an optional table property that tells Polaris where to write those metadata files. For a table already registered in a...

GHSA-FC3H-C6H7-R83J Apache Polaris has an Improper Input Validation issue

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials b...

GHSA-VXGG-MQX2-3W59 Apache Polaris has an Improper Input Validation Issue

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

Expression Language Injection

Overview org.apache.polaris:polaris-core is an a catalog for data lakes. It provides new levels of choice, flexibility and control over data, with full enterprise security and Apache Iceberg interoperability across a multitude of engines and infrastructure Affected versions of this package are...