CVE-2026-64640

CVE-2026-64640 — Apache Polaris：register 中在位置验证之前发放凭证 这是一个自包含、单命令的 CVE-2026-64640 复现工具：Apache Polaris 中的 Iceberg REST register 端点会为调用者提供的路径发放云存储凭证，并在根据目录的 allowedLocations 检查该路径之前 ，于服务端读取该路径。 一个仅拥有在其自身目录中创建表权限的主体，可以迫使 Polaris 使用该目录的存储凭证，去读取该目录本不允许接触的对象——另一个租户的前缀、另一个存储桶，以及存储主体能够访问到的任何内容。 | ---|---...

polaris

Polaris 是 Kubernetes 的一个开源策略引擎 Polaris 是 Kubernetes 的一个开源策略引擎，用于验证和修复资源配置。它包含 30 多个内置配置策略，并支持使用 JSON Schema 构建自定义策略。当以命令行模式或作为突变 Webhook 运行时，Polaris 能够根据策略标准自动修复问题。 Polaris 可以在三种不同模式下运行： 作为仪表盘 - 根据策略即代码验证 Kubernetes 资源。 作为准入控制器 - 自动拒绝或修改不符合组织策略的工作负载。 作为命令行工具 - 将策略即代码集成到 CI/CD 流程中，用于测试本地 YAML 文件。...

CVE-2026-97395

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395

In Apache Polaris versions

CVE-2026-97395 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

EUVD-2026-88960

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395: Undefined Security Weakness

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

polaris v10.2.3

Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fixed UBSAN array-index out-of-bounds issues for Polaris and Tonga. For pptable structures that use flexible array sizes, use flexible arrays instead...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: steampipe, loki-fips, flux-fips, amazon-k8s-cni-fips, flux-operator, flux-helm-controller, aws-load-balancer-controller-fips, gotenberg, grafana-operator-fips, flux-source-watcher, librechat, victoriametrics-cluster-fips, victorialogs, grafana-fips, grafana-operator,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: pluto, flux-image-automation-controller, nova, flux-source-controller, go, podinfo, dkron, metacontroller, terragrunt, grafana-rollout-operator, grafana-operator, polaris, victoriametrics, victoriametrics-cluster, stakater-reloader, steampipe, flux-helm-controller,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: pluto, flux-image-automation-controller, nova, flux-source-controller, go, podinfo, dkron, metacontroller, terragrunt, grafana-rollout-operator, grafana-operator, polaris, victoriametrics, victoriametrics-cluster, stakater-reloader, steampipe, flux-helm-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: wait-for-port, delve, portieris, glow, wgcf, amazon-cloudwatch-agent-operator, clickhouse-operator, nri-haproxy, aws-eks-pod-identity-agent, dex, nginx-prometheus-exporter, opentofu, kpt, dgraph, nri-mysql, harbor-cli, harbor-registry, nri-memcached, helm-operator,...

Exploit for Incorrect Authorization in Apache Polaris

CVE-2026-64640 — Apache Polaris: credential vending before loc...

PYSEC-2026-3623

Apache Polaris did not consistently validate storage locations supplied during table and view registration.An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials ...

CVE-2026-64640

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

PYSEC-2026-3623

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64640

Apache Polaris is affected by a storage-location validation flaw during table/view registration. An authenticated user with table- or view-registration privileges could trigger Polaris to use the catalog’s storage credentials to read a caller-supplied Iceberg metadata file before confirming it li...