Apache Polaris issues broad temporary storage credentials during staged table creation without validating or durably reserving the effective table location. An attacker can supply a custom location parameter to stage create requests, causing Polaris to immediately construct delegated storage credentials scoped to that location without performing normal validation or overlap checks. The staged-create flow also accepts write.data.path and write.metadata.path overrides, which influence the effective table location used for credential vending. These attacker-controlled inputs are not validated before credential issuance, resulting in missing authorization (CWE-862) and improper input validation (CWE-20). The CVSS 4.0 score is 9.4 (critical), reflecting network attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, availability, and security scope.

The vulnerability allows attackers with limited privileges to obtain delegated storage credentials scoped to arbitrary locations chosen by the attacker. This can lead to unauthorized access to sensitive table data and metadata, potentially compromising confidentiality and integrity of stored information. The broad scope of temporary credentials issued without proper validation increases the risk of data exposure or manipulation. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or temporary workaround documented at this time. Until a patch is available, avoid using the staged table creation feature with custom location parameters or credential vending. Monitor Apache Software Foundation advisories for updates and apply official fixes promptly once released.