Apache Polaris: wildcards in table names widen vended S3 credentials to other tables

Impact

Polaris accepts a literal * in namespace and table names and reuses it unescaped when building the temporary S3 IAM policy for delegated table access, where * is a wildcard rather than text. A user who creates a table named *.* or foo.* receives short-lived credentials that reach other tables' S3 prefixes. The advisory reports confirmed reads of another table's Iceberg metadata JSON - the control file naming every data file and snapshot - plus prefix listing and, where write delegation was granted, object create and delete under a victim table's prefix. It was reproduced on both MinIO and real AWS S3 against 1.4.0, including a least-privilege case where the attacker held no Polaris permission on the victim table at all. For a shared training-data lake this is cross-tenant access to the dataset layer, bypassing the catalog's own authorization.

Who can reach it

Any authenticated Polaris principal that can create a table and request delegated credentials - namespace-scoped TABLE_CREATE plus TABLE_WRITE_DATA was enough. No permission on the victim table is required.

What to do

The record points to the Apache announcement thread rather than naming a fixed release, so do not assume a version: check that thread, and in the meantime reject * (and other IAM-significant characters) in namespace and table names at creation, audit existing catalogs for such names, and tighten the IAM role Polaris assumes so vended credentials cannot span table prefixes. The fix is a service upgrade and restart, not a node operation.

References

Related entries

• CloudNativePG: a database owner escalates to PostgreSQL superuser and OS command execution in the podCVE-2026-55769 · CloudNativePG instance manager (unpinned search_path on superuser connections)Critical
• Gitea act_runner: workflow container options bypass privileged:false and escape to the hostCVE-2026-58053 · Gitea act_runner Docker backend (workflow container.options handling)Critical
• CloudNativePG instance manager (PostgreSQL connection search_path): The owner of any managed database — a roleNCVD-2026-048-cloudnativepg-instance-manager-p · CloudNativePG instance manager (PostgreSQL connection search_path)Critical
• Pure Storage FlashBlade management interface authentication: An attacker authenticates to the FlashBlade managementCVE-2023-4976 · Pure Storage FlashBlade management interface authenticationCritical
• MinIO (admin IAM import API): The IAM import API can be driven to grant an attacker administrative policy, converting aCVE-2024-55949 · MinIO (admin IAM import API)Critical
• Renovate: shell metacharacters in helmv3 registryAliases give commit-access users command executionCVE-2024-58376 · Renovate (helmv3 manager, registryAliases handling)Critical