Skip to content
VulniPulse
Sign in
Advisory severityHigh8.1Apache Software Foundation

High [CVE-2026-97395] Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata

This high-severity Apache Software Foundation advisory covers CVE-2026-97395; related products: Apache Polaris.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-97395 Source published Source updated

VulniPulse record published Record updated

CVE-2026-97395
Related products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.

In versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send storage requests to a host chosen by the table writer, using credentials scoped to the operation.

This can redirect server-side storage traffic and expose request authentication material to the chosen endpoint. Deployments are affected when table writers are not trusted to configure server-side storage endpoints.

Affected versions
  • Apache Polaris before 1.8.0

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Fixed versions
  • 1.8.0

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.
  • Deployments are affected when table writers are not trusted to configure server-side storage endpoints.

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.