---
title: "CVE-2026-42809: Apache Polaris has an Improper Input Validation Issue"
url: https://erroneo.us/security/cve/CVE-2026-42809/
description: "CVE-2026-42809 (org.apache.polaris:polaris-runtime-service (Maven)): Apache Polaris can issue broad temporary (\"vended\") storage credentials during staged…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-05-04
date_modified: 2026-05-08
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-42809"
kev: false
cvss: 9.4
epss: 0.00576
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-42809: Apache Polaris has an Improper Input Validation Issue

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.6% , percentile 47: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 47% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes org.apache.polaris:polaris-runtime-service (Maven) < 1.4.1, fixed in 1.4.1 . Check your lockfile, including transitive dependencies.

## What it is

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation becomes attacker- directed because the attacker can choose a reachable target location. In the confirmed variant, if the caller supplies a custom location during stage create and requests credential vending, Apache Polaris uses that location to construct delegated storage credentials immediately. The stage-create path itself neither runs the normal location validation nor the overlap checks before those credentials are issued. Closely related to that, the staged-create flow also accepts write.data.path / write.metadata.path in the request properties and feeds those location overrides into the same effective table location set used for credential vending. Those fields are secondary to the main custom-location exploit, but they are still attacker-influenced location inputs that should be validated before any credentials are issued.

## Affected packages

- Maven `org.apache.polaris:polaris-runtime-service` < 1.4.1 → fixed: 1.4.1

## Affected products (CVE record)

- Apache Software Foundation Apache Polaris: < 1.4.1

## Severity

- apache CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- apache CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.58% probability of exploitation activity in the next 30 days; percentile 47.

## Sources

- [lists.apache.org](https://lists.apache.org/thread/8tfsr8y7pgq6rdcvjx95hkcr47td671r)
- [GitHub Advisory GHSA-8ggj-j522-h5qf](https://github.com/advisories/GHSA-8ggj-j522-h5qf)
- [CVE.org record CVE-2026-42809](https://www.cve.org/CVERecord?id=CVE-2026-42809)
- [NVD entry CVE-2026-42809](https://nvd.nist.gov/vuln/detail/CVE-2026-42809)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/05/02/10)
- [github.com](https://github.com/apache/polaris/commit/c98d610bc8f7ee237b272e01814391838dd6abf9)
- [github.com](https://github.com/apache/polaris/releases/tag/apache-polaris-1.4.1)

---
Source page: https://erroneo.us/security/cve/CVE-2026-42809/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt