CVE-2026-42812: Apache Polaris improper validation of write.metadata.path

CVE-2026-42812 · Severity: critical · CVSS 9.9 · Published 2026-05-04

Apache Polaris is a data cataloging service that manages Apache Iceberg table metadata stored in cloud storage. A vulnerability allows authenticated users with table modification permissions to redirect metadata writes to attacker-controlled storage locations, bypassing security validation checks. This could expose sensitive table metadata and data to unauthorized access or modification, particularly if cloud credentials are later issued for the poisoned location.

Technologies: Apache Polaris. Vendors: Apache, Maven.

Quick answers

Is CVE-2026-42812 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42812 being exploited in the wild.
How severe is CVE-2026-42812?
Critical severity, with a CVSS score of 9.9, published 4 May 2026.
Which products and versions are affected?
org.apache.polaris:polaris-runtime-service (Maven) >= 0.9.0, < 1.4.1, ECOSYSTEM:introduced=0.9.0,fixed=1.4.1.
Is there a fix for CVE-2026-42812?
Yes. org.apache.polaris:polaris-runtime-service (Maven): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42812 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42812?
Check whether you run Apache Polaris or org.apache.polaris:polaris-runtime-service (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.polaris:polaris-runtime-service (Maven): upgrade to 1.4.1 or later
    # set org.apache.polaris:polaris-runtime-service to 1.4.1 in your pom.xml or build.gradle

Technical details

The vulnerability is an improper input validation flaw (CWE-20) in Apache Polaris's handling of the `write.metadata.path` table property. When a user modifies only this property via ALTER TABLE settings (not row-level DML), Polaris skips its intended location-validation commit-time check. This allows an authenticated attacker with table modification privileges to cause Polaris to write table metadata to an arbitrary storage location before validation occurs. In configurations where `polaris.config.allow.unstructured.table.location=true` and `allowedLocations` is broad, the attacker can target paths outside the intended table directory. If subsequent validation also accepts the poisoned location, Polaris persists it in table state; later credential-vending APIs may then issue temporary cloud storage access for that location without revalidation. The practical impact extends beyond credential vending—Polaris itself performs the unsafe metadata write to the unchecked location. The defect exists regardless of the unstructured location flag, though the flag controls whether the metadata path is later persisted. Affected versions 0.9.0 through 1.4.0 are patched in version 1.4.1.

Affected products

  • Apache Polaris 0.9.0 through 1.4.0

Identifiers

  • CVE-2026-42812
  • GHSA-w76p-3cgp-qfcm

Timeline

  • 2026-05-04: disclosed
  • 2026-05-04: patched: Version 1.4.1 patches the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.