Threats tagged 'ghsa-62q9-5g2h-5gxp'

Apache Polaris contains an authorization flaw where storage locations supplied during table and view registration are not consistently validated. An authenticated user with table or view registration permissions could cause Polaris to read an Iceberg metadata file outside the allowed storage boundaries if the catalog's storage credentials permit it. This could lead to limited confidential information disclosure. No unauthorized data modification or availability impact has been demonstrated. Exploitation requires specific deployment conditions including S3 credential vending and appropriate permissions.