Apache Software Foundation Apache Polaris

• CVE-2026-97395 High 8.1 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials 0.3%
• CVE-2026-64640 Medium 6.5 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation 0.5%
• CVE-2026-42810 Critical 9.9 Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names 0.4%
• CVE-2026-42811 Critical 9.9 Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions 0.4%
• CVE-2026-42809 Critical 9.9 Apache Polaris: staged table creation could vend storage credentials for unvalidated locations 0.4%
• CVE-2026-42812 Critical 9.9 Apache Polaris: No protection on `write.metadata.path` 0.4%