{"id":"CVE-2026-97395","revision":"f7cf85f5d82b420cbff9f3da108458d1","records":[{"revision":"f7cf85f5d82b420cbff9f3da108458d1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97395","aliases":[],"title":"Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials","description":"Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.\n\n\nIn versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send storage requests to a host chosen by the table writer, using credentials scoped to the operation.\n\n\n\n\nThis can redirect server-side storage traffic and expose request authentication material to the chosen endpoint. Deployments are affected when table writers are not trusted to configure server-side storage endpoints.","state":0,"publishedAt":"2026-09-29T13:57:32.682+00:00","modifiedAt":"2026-10-01T16:13:41.152+00:00","affected":[{"ecosystem":"Vendor product","name":"Apache Polaris","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"product\": \"Apache Polaris\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.8.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://lists.apache.org/thread.html/nrk339vtlkpsjw3mg4mqw52j0167wyph"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97395","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97395","identifiers":["CVE-2026-97395"]},"retained":false,"historicalAffected":[]}],"coverage":[]}