CVE-2026-42809 - Apache Polaris: An authenticated low-privileged user can abuse Polaris staged table creation to mint broad temporary storage credentials for an attacker-chosen location before Polaris validates that location

CVE ID :CVE-2026-42809 Published : May 4, 2026, 4:22 p.m. | 31 minutes ago Description :Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials