CVE-2026-64640 describes an incorrect authorization vulnerability (CWE-863) in Apache Polaris where storage locations provided during table and view registration are not consistently validated. Authenticated principals with registration privileges might cause Polaris to use catalog storage credentials to read Iceberg metadata files outside authorized storage boundaries, potentially disclosing limited confidential information. The vulnerability requires a deployment using S3 credential vending and that the catalog's credentials can access objects outside allowed locations. No evidence of data modification or availability impact exists. The flaw is limited to confidentiality exposure and requires authenticated access with specific privileges.

The impact is limited to confidentiality, allowing an authenticated user with table or view registration permissions to potentially read metadata files outside the allowed storage locations if the catalog's credentials permit. There is no demonstrated impact on data integrity or availability. Exploitation requires specific deployment configurations and privileges, limiting the scope of potential attackers.

A patch is available for this vulnerability. Since Apache Polaris is a cloud service, the vendor typically manages remediation server-side. Users should consult the vendor advisory for confirmation and ensure their deployments are updated accordingly. No additional mitigation actions are indicated by the vendor advisory.