What’s Vulnerable › Products

Apache Software Foundation Apache Polaris vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Apache Software Foundation Apache Polaris version is affected

Latest Apache Software Foundation Apache Polaris vulnerabilities

• CVE-2026-97395 — Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials (CVSS 8.1)
• CVE-2026-64640 — Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation (CVSS 6.5)
• CVE-2026-42812 — Apache Polaris: No protection on `write.metadata.path` (CVSS 9.9)
• CVE-2026-42811 — Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions (CVSS 9.9)
• CVE-2026-42810 — Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names (CVSS 9.9)
• CVE-2026-42809 — Apache Polaris: staged table creation could vend storage credentials for unvalidated locations (CVSS 9.9)