# CVE-2026-42809: Apache Polaris improper authorization in staged table creation

Source: https://junglewise.ai/threats/cve-2026-42809-apache-polaris-improper-authorization-in-staged-table-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42809 · Severity: critical · CVSS 9.9 · Published 2026-05-04

Apache Polaris, a data management service, contains a security flaw that allows users to obtain unauthorized access to cloud storage. By providing a custom storage location during the table creation process, an attacker can trick the system into issuing temporary security credentials for locations they should not be able to access. This could lead to the unauthorized viewing, modification, or deletion of sensitive data stored in the cloud.

Technologies: [Apache Polaris](https://junglewise.ai/threats/technologies/polaris). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-42809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42809 being exploited in the wild.

**How severe is CVE-2026-42809?** Critical severity, with a CVSS score of 9.9, published 4 May 2026.

**Which products and versions are affected?** org.apache.polaris:polaris-runtime-service (Maven) ECOSYSTEM:introduced=0,fixed=1.4.1.

**Is there a fix for CVE-2026-42809?** Yes. org.apache.polaris:polaris-runtime-service (Maven): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42809 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42809?** Check whether you run Apache Polaris or org.apache.polaris:polaris-runtime-service (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.polaris:polaris-runtime-service (Maven): upgrade to 1.4.1 or later

  ```sh
  # set org.apache.polaris:polaris-runtime-service to 1.4.1 in your pom.xml or build.gradle
  ```


## Technical details

Apache Polaris is vulnerable to an authorization bypass and improper input validation during the 'staged table creation' workflow. When a user initiates a stage-create request with a custom 'location' and requests credential vending, the application generates delegated storage credentials immediately without performing standard location validation or overlap checks. Attackers can also influence the credential scope via 'write.data.path' and 'write.metadata.path' properties. This allows an authenticated, low-privileged user to mint temporary credentials for any reachable target location they specify. The issue is addressed in Apache Polaris version 1.4.1.

## Affected products

- Apache Polaris before 1.4.1

## Identifiers

- CVE-2026-42809
- GHSA-8ggj-j522-h5qf

## Timeline

- 2026-05-02: disclosed: Initial disclosure on oss-security mailing list
- 2026-05-04: advisory: NVD publication date
- 2026-05-12: other: NVD analysis and CPE assignment

## References

- [https://lists.apache.org/thread/8tfsr8y7pgq6rdcvjx95hkcr47td671r](https://lists.apache.org/thread/8tfsr8y7pgq6rdcvjx95hkcr47td671r)
- [http://www.openwall.com/lists/oss-security/2026/05/02/10](http://www.openwall.com/lists/oss-security/2026/05/02/10)

## Related threats

- [Apache Polaris arbitrary FileIO endpoint configuration](https://junglewise.ai/threats/cve-2026-97395-apache-polaris-allows-an-authenticated-principal-with-permission)
- [Apache Polaris improper validation of write.metadata.path](https://junglewise.ai/threats/cve-2026-42812-apache-polaris-improper-validation-of-write-metadata-path)
- [Apache Polaris expression injection in GCS credential delegation](https://junglewise.ai/threats/cve-2026-42811-apache-polaris-expression-injection-in-gcs-credential-delegation)
- [Apache Polaris improper escaping in S3 delegated access policies](https://junglewise.ai/threats/cve-2026-42810-apache-polaris-improper-escaping-in-s3-delegated-access-policies)