CVE-2026-42810: Improper Encoding or Escaping of Output

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

PT-2026-36669

Name of the Vulnerable Software and Affected Versions Apache Polaris version 1.4.0 Description Apache Polaris allows the use of literal characters in namespace and table names. These characters are reused unescaped in S3 IAM resource patterns and s3:prefix conditions when building temporary S3...