Incorrect Authorization Affecting org.apache.polaris:polaris-runtime-service package, versions [,1.4.1)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHEPOLARIS-16422548
- published6 May 2026
- disclosed4 May 2026
- creditUnknown
Introduced: 4 May 2026
CVE-2026-42812 (opens in a new tab)How to fix?
Upgrade org.apache.polaris:polaris-runtime-service to version 1.4.1 or higher.
Overview
org.apache.polaris:polaris-runtime-service is an a catalog for data lakes. It provides new levels of choice, flexibility and control over data, with full enterprise security and Apache Iceberg interoperability across a multitude of engines and infrastructure
Affected versions of this package are vulnerable to Incorrect Authorization through the optional write.metadata.path property. An attacker can cause unauthorized metadata to be written to an attacker-controlled storage location by altering table settings, leading to exposure, modification, or deletion of data and metadata.
Note: This is only exploitable if polaris.config.allow.unstructured.table.location=true and the allowedLocations configuration includes the attacker-chosen target.