Polaris (Apache) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 44 known versions, newest CVE from 2026-08-06. Vendor: Apache.

CVEs of Polaris

• CVE-2026-64640 - CVSS 6.5 (medium), 2026-08-06: Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to…
• CVE-2026-42811 - CVSS 9.9 (critical), 2026-05-04: In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name…
• CVE-2026-42810 - CVSS 9.9 (critical), 2026-05-04: Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access,…
• CVE-2026-42809 - CVSS 9.9 (critical), 2026-05-04: Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or…
• CVE-2026-42812 - CVSS 9.9 (critical), 2026-05-04: In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read.…