Loading vulnerability…
CVE-2026-42809 is a critical vulnerability in Apache Polaris in which the staged table creation workflow can issue temporary delegated storage credentials for an attacker-controlled location before the effective table location is validated or durably reserved. In the confirmed exploit path, an authenticated low-privilege user submits a stage-create request with credential vending enabled and supplies a custom table location. Polaris immediately uses that user-controlled location to construct vended storage credentials without first performing the normal location validation and overlap checks. The staged-create flow also accepts attacker-influenced location overrides through write.data.path and write.metadata.path, and those values are incorporated into the effective table location set used for credential vending. The weakness is fundamentally a logic flaw combining improper input validation and missing authorization in the credential vending path, allowing the intended scope restriction on temporary credentials to become attacker-directed.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical improper validation/authorization flaw in Apache Polaris credential vending that allows a low-privileged authenticated user to obtain temporary cloud storage credentials for arbitrary storage paths via the stage-create flow.
An Apache Polaris vulnerability in which attacker-controlled table location inputs during staged table creation can cause the system to issue overly broad temporary storage credentials before validation, enabling attacker-directed access scope.
A related Apache Polaris vulnerability involving abuse of staged table creation to obtain overly broad temporary storage credentials.
An Apache Polaris vulnerability allowing authenticated low-privileged users to abuse staged table creation to obtain broad temporary storage credentials for an attacker-chosen location.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.