CVE-2026-64640

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64640", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-20T16:49:22.785Z", "datePublished": "2026-08-06T09:08:06.534Z", "dateUpdated": "2026-08-06T21:56:16.978Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "org.apache.polaris:polaris-runtime-service", "product": "Apache Polaris", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Andrea Cosentino"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Apache Polaris did not consistently validate storage locations supplied during table and view registration.<br><br><div>An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations.</div><div>If the catalog's underlying credentials could read an object outside&nbsp;that boundary, this could disclose limited information from the object.</div><br><div>Polaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary.</div><div>This second condition did not itself cause Polaris to read the&nbsp;referenced external locations during registration.</div><br><div>The demonstrated impact is limited to confidentiality.</div><div>No unauthorized data&nbsp;modification or availability impact has been demonstrated.</div><br><div>The server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read.</div><div>Exploitation requires an authenticated principal with&nbsp;table- or view-registration privileges.</div>"}], "value": "Apache Polaris did not consistently validate storage locations supplied during table and view registration.\n\nAn authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations.\n\nIf the catalog's underlying credentials could read an object outside\u00a0that boundary, this could disclose limited information from the object.\n\n\nPolaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary.\n\nThis second condition did not itself cause Polaris to read the\u00a0referenced external locations during registration.\n\n\nThe demonstrated impact is limited to confidentiality.\n\nNo unauthorized data\u00a0modification or availability impact has been demonstrated.\n\n\nThe server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read.\n\nExploitation requires an authenticated principal with\u00a0table- or view-registration privileges."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T09:08:06.534Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/scd8p9wy8b9j3om5wohbotpfycnmmjl4"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T15:12:23.821798Z", "id": "CVE-2026-64640", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T15:13:04.986Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:16.978Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-64640", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T15:12:23.821798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T15:12:54.845Z"}}], "cna": {"title": "Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Andrea Cosentino"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}, {"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/U:Clear", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Polaris", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.0"}], "packageName": "org.apache.polaris:polaris-runtime-service", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/scd8p9wy8b9j3om5wohbotpfycnmmjl4", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Polaris did not consistently validate storage locations supplied during table and view registration.\n\nAn authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations.\n\nIf the catalog's underlying credentials could read an object outside\u00a0that boundary, this could disclose limited information from the object.\n\n\nPolaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary.\n\nThis second condition did not itself cause Polaris to read the\u00a0referenced external locations during registration.\n\n\nThe demonstrated impact is limited to confidentiality.\n\nNo unauthorized data\u00a0modification or availability impact has been demonstrated.\n\n\nThe server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read.\n\nExploitation requires an authenticated principal with\u00a0table- or view-registration privileges.", "supportingMedia": [{"type": "text/html", "value": "Apache Polaris did not consistently validate storage locations supplied during table and view registration.<br><br><div>An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations.</div><div>If the catalog's underlying credentials could read an object outside&nbsp;that boundary, this could disclose limited information from the object.</div><br><div>Polaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary.</div><div>This second condition did not itself cause Polaris to read the&nbsp;referenced external locations during registration.</div><br><div>The demonstrated impact is limited to confidentiality.</div><div>No unauthorized data&nbsp;modification or availability impact has been demonstrated.</div><br><div>The server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read.</div><div>Exploitation requires an authenticated principal with&nbsp;table- or view-registration privileges.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T09:08:06.534Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64640", "state": "PUBLISHED", "dateUpdated": "2026-08-06T15:13:04.986Z", "dateReserved": "2026-07-20T16:49:22.785Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-06T09:08:06.534Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "org.apache.polaris:polaris-runtime-service", "product": "Apache Polaris", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:polaris:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CD70FFD-6F3C-4616-A4AF-57EB734A19C6", "versionEndIncluding": "1.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Polaris did not consistently validate storage locations supplied during table and view registration.\n\nAn authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations.\n\nIf the catalog's underlying credentials could read an object outside\u00a0that boundary, this could disclose limited information from the object.\n\n\nPolaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary.\n\nThis second condition did not itself cause Polaris to read the\u00a0referenced external locations during registration.\n\n\nThe demonstrated impact is limited to confidentiality.\n\nNo unauthorized data\u00a0modification or availability impact has been demonstrated.\n\n\nThe server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read.\n\nExploitation requires an authenticated principal with\u00a0table- or view-registration privileges."}, {"lang": "es", "value": "Apache Polaris no validaba consistentemente las ubicaciones de almacenamiento proporcionadas durante el registro de tablas y vistas.\n\nUn principal autenticado con permiso para registrar una tabla o vista podr\u00eda, dependiendo de la versi\u00f3n afectada y la ruta de registro, hacer que Polaris usara las credenciales de almacenamiento del cat\u00e1logo para leer un archivo de metadatos de Iceberg seleccionado por el llamador antes de verificar que el archivo estuviera dentro de las ubicaciones de almacenamiento permitidas del cat\u00e1logo.\n\nSi las credenciales subyacentes del cat\u00e1logo pudieran leer un objeto fuera de ese l\u00edmite, esto podr\u00eda divulgar informaci\u00f3n limitada del objeto.\n\nPolaris tambi\u00e9n podr\u00eda aceptar metadatos de registro ubicados dentro de una ubicaci\u00f3n permitida que conten\u00edan referencias a ubicaciones de almacenamiento fuera del l\u00edmite permitido.\n\nEsta segunda condici\u00f3n no caus\u00f3 por s\u00ed misma que Polaris leyera las ubicaciones externas referenciadas durante el registro.\n\nEl impacto demostrado se limita a la confidencialidad.\n\nNo se ha demostrado ninguna modificaci\u00f3n de datos no autorizada o impacto en la disponibilidad.\n\nLa lectura del lado del servidor requiere una implementaci\u00f3n que utilice la dispensaci\u00f3n de credenciales S3 y un objeto fuera de las ubicaciones permitidas que las credenciales de almacenamiento subyacentes del cat\u00e1logo puedan leer.\n\nLa explotaci\u00f3n requiere un principal autenticado con privilegios de registro de tablas o vistas."}], "id": "CVE-2026-64640", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64640", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T15:12:23.821798Z", "version": "2.0.3"}}]}, "published": "2026-08-06T09:16:36.797", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/scd8p9wy8b9j3om5wohbotpfycnmmjl4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/08/06/7"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Polaris", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "polaris", "vendor": "apache"}], "created": "2026-08-06T10:30:16.647227+00:00", "updated": "2026-08-06T12:00:06.251017+00:00", "vendors": ["apache", "apache$PRODUCT$polaris"]}