CVE-2026-64640 describes an incorrect authorization vulnerability (CWE-863) in Apache Polaris. The product does not consistently validate storage locations during table and view registration, allowing an authenticated principal with registration privileges to cause the system to read Iceberg metadata files outside the allowed storage boundaries if the catalog's credentials permit access. This results in limited confidentiality impact due to potential unauthorized disclosure of data. The vulnerability requires a deployment using S3 credential vending and an object outside allowed locations accessible by the catalog's storage credentials. No integrity or availability impacts have been demonstrated.

The impact is limited to confidentiality, specifically the potential disclosure of limited information from objects outside the allowed storage locations. There is no demonstrated impact on data modification or service availability. Exploitation requires authenticated access with table or view registration privileges and specific deployment conditions.

A patch is available for this vulnerability. Since Apache Polaris is a cloud service, the vendor typically manages remediation server-side. Users should consult the vendor advisory for confirmation and ensure their deployments are updated accordingly to prevent unauthorized disclosure. No additional mitigation steps are indicated by the vendor advisory.