# CVE-2026-97395: Apache Polaris arbitrary FileIO endpoint configuration

Source: https://junglewise.ai/threats/cve-2026-97395-apache-polaris-allows-an-authenticated-principal-with-permission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-97395 · Severity: info · Published 2026-09-29

Apache Polaris is a catalog service for managing Iceberg tables in cloud storage. When table writers with modification permissions inject custom FileIO settings, Polaris's server-side operations (such as committing or purging data) can be tricked into sending storage requests to an attacker-controlled endpoint, potentially exposing authentication credentials. This affects deployments where table writers are not fully trusted.

Technologies: [Apache Polaris](https://junglewise.ai/threats/technologies/polaris). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-97395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97395 being exploited in the wild.

**How severe is CVE-2026-97395?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Apache Polaris < 1.8.0.

**Is there a fix for CVE-2026-97395?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97395 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-97395?** Check whether you run Apache Polaris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

In Apache Polaris versions before 1.8.0, authenticated principals with permission to create or update Iceberg table properties can inject FileIO client settings (e.g., s3.endpoint) into table metadata. When Polaris performs server-side operations that construct a FileIO client, it may use these attacker-controlled settings if the catalog storage configuration does not override them, allowing requests to be redirected to an arbitrary endpoint with the server's credentials. The vulnerability requires prior authentication and table modification privileges.

## Affected products

- Apache Polaris < 1.8.0

## Timeline

- 2026-09-29: disclosed

## References

- [https://lists.apache.org/thread.html/nrk339vtlkpsjw3mg4mqw52j0167wyph](https://lists.apache.org/thread.html/nrk339vtlkpsjw3mg4mqw52j0167wyph)

## Related threats

- [Apache Polaris improper validation of write.metadata.path](https://junglewise.ai/threats/cve-2026-42812-apache-polaris-improper-validation-of-write-metadata-path)
- [Apache Polaris expression injection in GCS credential delegation](https://junglewise.ai/threats/cve-2026-42811-apache-polaris-expression-injection-in-gcs-credential-delegation)
- [Apache Polaris improper escaping in S3 delegated access policies](https://junglewise.ai/threats/cve-2026-42810-apache-polaris-improper-escaping-in-s3-delegated-access-policies)
- [Apache Polaris improper authorization in staged table creation](https://junglewise.ai/threats/cve-2026-42809-apache-polaris-improper-authorization-in-staged-table-creation)