CVE-2026-64640: 
Python vulnerability analysis and mitigation

CVE-2026-64640 is an Incorrect Authorization vulnerability in Apache Polaris that allows authenticated users to read Iceberg metadata files outside the catalog's allowed storage boundaries using the catalog's own S3 credentials. Affecting Apache Polaris (org.apache.polaris:polaris-runtime-service) versions through 1.6.0, the vulnerability was disclosed on August 6, 2026, by Apache Software Foundation, with credit to finder Andrea Cosentino. It carries a CVSS v3.1 score of 6.5 (Medium) per CISA-ADP and a CVSS v4.0 score of 5.3 (Medium) per the Apache CNA (Apache Advisory, GitHub Advisory).

The root cause is CWE-863 (Incorrect Authorization): Apache Polaris's table and view registration endpoint reads a caller-supplied Iceberg metadata file using the catalog's storage credentials before validating that the file path falls within the catalog's configured allowed storage locations (oss-security). A secondary condition allows registration metadata within an allowed location to reference external storage paths, though Polaris does not itself read those external references during registration. Exploitation requires a network-accessible Polaris deployment configured with S3 credential vending, where the catalog's underlying credentials have read access to objects outside the allowed location boundary. The attack vector is network-based, requires low privileges (table/view registration rights), and no user interaction (GitHub Advisory, oss-security).

Successful exploitation is limited to a confidentiality impact — no unauthorized data modification or availability impact has been demonstrated. An authenticated attacker can cause the Polaris server to read an attacker-chosen Iceberg metadata file outside the catalog's allowed storage boundary using the catalog's own S3 credentials, potentially disclosing limited information from that object. The scope of disclosure depends on what objects the catalog's underlying credentials can access beyond the configured boundary (Apache Advisory, oss-security).

A public proof-of-concept exploit (exploit.sh) is available on GitHub, providing a self-contained, runnable script that demonstrates the authorization bypass against real Apache Polaris deployments using Docker Compose (PoC GitHub). As of the time of disclosure, there is no evidence of in-the-wild exploitation, and CISA's SSVC assessment notes exploitation as "none" and the vulnerability as not automatable (GitHub Advisory). The EPSS score is approximately 0.255–0.359%, placing it in roughly the 29th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Apache Polaris deployments running version 1.6.0 or earlier that are configured with S3 credential vending. Confirm the target has accessible table or view registration endpoints.
2. Obtain authenticated access: Acquire credentials for a principal with table- or view-registration privileges on the target Polaris catalog (e.g., via a legitimate account, compromised credentials, or a low-privilege trial account).
3. Craft malicious registration request: Prepare a table or view registration request that specifies a caller-controlled Iceberg metadata file path pointing to an S3 object outside the catalog's configured allowed storage locations.
4. Submit registration request: Send the crafted HTTP request to the Polaris register endpoint. Because Polaris reads the metadata file before validating the storage location, it will use the catalog's S3 credentials to fetch the attacker-specified object.
5. Exfiltrate disclosed data: Analyze the server's response or side-channel behavior to extract limited information from the object read by the catalog's credentials, which may include sensitive metadata from outside the intended storage boundary (PoC GitHub, oss-security).

• Network: Unexpected outbound S3 API read requests (e.g., GetObject) from the Polaris server to S3 paths outside the catalog's configured allowed storage locations; unusual S3 access patterns in AWS CloudTrail logs referencing objects not associated with known catalog namespaces.
• Logs: Polaris server logs showing table or view registration requests with metadata file paths pointing to external or unexpected S3 URIs; repeated registration attempts with varying external S3 paths from the same principal.
• Application Behavior: Table or view registration calls that reference Iceberg metadata files in S3 buckets or prefixes not listed in the catalog's allowed-locations configuration; registration requests that fail validation after the server has already performed an S3 read.

Apache released security fixes for CVE-2026-64640 on August 6–8, 2026; users should upgrade org.apache.polaris:polaris-runtime-service to a version beyond 1.6.0 that includes the fix (Apache Advisory). As an interim measure, restrict table and view registration privileges to only fully trusted principals, and review S3 credential vending configurations to minimize the scope of what the catalog's underlying credentials can access. Ensure catalog allowed-locations boundaries are tightly scoped to reduce the potential impact of any unauthorized reads.

The vulnerability was announced on the Apache security mailing list and oss-security by Apache committer Alexandre Dutra on August 6, 2026, with credit to finder Andrea Cosentino (oss-security). It was noted in the Apache Data Lakehouse Weekly newsletter for August 5–12, 2026, indicating awareness within the data engineering community. Social media activity was limited, with automated CVE notification accounts on platforms like Bluesky and Nitter flagging the disclosure shortly after publication.