CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpo

CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials

Reported by oss-security

Summary by Cyber Security News29 Sep 2026, 16:02 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/999

Posted by Jean-Baptiste Onofré on Sep 29 Severity: important Affected versions: - Apache Polaris before 1.8.0 Description: Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Keyorix: Open-source secrets management for teams that can’t use SaaS

CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective

CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

CVE-2026-97631: Pre-boot RCE in EDK II PXE driver