Threats Tagged 'ghsa-848v-j2j6-p92w'

CVE-2026-97395 is a vulnerability in Apache Polaris versions prior to 1.8.0 that allows an authenticated user with permission to create or update Iceberg table properties to manipulate FileIO client settings such as s3.endpoint in table metadata. This can cause server-side storage requests to be redirected to an attacker-controlled endpoint, potentially exposing authentication credentials. The vulnerability affects deployments where table writers are not trusted to configure storage endpoints. A patch is available, and since Apache Polaris is a cloud service, the vendor manages remediation.