Apache Polaris runtime service versions prior to 1.4.1 contain an improper input validation vulnerability (CVE-2026-42809) that allows an attacker to influence the scope of temporary storage credentials issued during staged table creation. By supplying a custom location or overriding write paths, attackers can cause the system to issue delegated storage credentials scoped to attacker-chosen locations without proper validation or overlap checks. This can lead to unauthorized access to table data and metadata. A fix is available in version 1.4.1.