Detections
Analytics

SCA: security update for org.apache.polaris:polaris-runtime-service (GHSA-w76p-3cgp-qfcm)

critical Tenable Cloud Security Plugin ID 441549

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong
 to the table and which table version to read. `write.metadata.path` is an optional table property that
 tells Polaris where to write those metadata files. For a table already registered in a Polaris-managed
 catalog, changing only that property through an `ALTER TABLE`-style settings change (not a row-level
 `INSERT`, `SELECT`, `UPDATE`, or `DELETE`) bypasses the commit-time branch that is supposed to revalidate
 storage locations. The full persisted / credential-vending variant requires the affected catalog to have
 `polaris.config.allow.unstructured.table.location=true`, with `allowedLocations` broad enough to include
 the attacker-chosen target. `allowedLocations` is the admin-configured allowlist of storage paths that the
 catalog is allowed to use. Public project materials suggest that this flag is a real supported
 compatibility / layout mode, not just a contrived lab-only prerequisite. In that configuration, a user who
 can change table settings can cause Apache Polaris itself to write new table metadata to an attacker-
 chosen reachable storage location before the intended location-validation branch runs. If the later
 concrete-path validation also accepts that location, Polaris persists the resulting metadata path into
 stored table state. Later table-load and credential APIs can then return temporary cloud-storage
 credentials for the same location without revalidating it. In plain terms, Polaris can later hand out
 temporary storage access for the same attacker-chosen area. That attacker-chosen area does not need to be
 limited to the poisoned table's own files. If it is a broader storage prefix, another table's prefix, or,
 depending on configuration or provider behavior, even a bucket/container root, the resulting disclosure or
 corruption scope can extend to any data and metadata Polaris can reach there. The practical consequences
 are therefore similar to the staged-create credential-vending issue already discussed: data and metadata
 reachable in that storage scope can be exposed and, if write-capable credentials are later issued,
 modified, corrupted, or removed. Even before that later credential step, Polaris itself performs the
 metadata write to the unchecked location. So the core issue is not only later credential vending. The
 primary defect is that Polaris skips its intended location checks before performing a security- sensitive
 metadata write when only `write.metadata.path` changes. When
 `polaris.config.allow.unstructured.table.location=false`, current code review suggests the later
 `updateTableLike(...)` validation usually rejects out-of-tree metadata locations before the unsafe path is
 persisted. That may reduce the persisted / credential-vending variant, but it does not prevent the
 underlying defect: Polaris still skips the intended pre-write location check when only
 `write.metadata.path` changes. (CVE-2026-42812)

Solution

Update the org.apache.polaris:polaris-runtime-service library and its related packages to version 1.4.1 or later.

See Also

https://github.com/advisories/GHSA-w76p-3cgp-qfcm

Plugin Details

Severity: Critical

ID: 441549

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/8/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.07

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-42812

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.4

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/4/2026

Vulnerability Publication Date: 5/4/2026

Reference Information

CVE: CVE-2026-42812

cwe: CWE-20