Apache Polaris allows an authenticated low‑privileged user to request staged table creation with a custom location or write.data.path/write.metadata.path values. The service immediately generates delegated storage credentials for the requested location before performing normal location validation or overlap checks. This bypasses intended scope restriction, enabling the attacker to obtain unrestricted access to an arbitrary storage location, thereby exposing sensitive data and metadata. The vulnerability is rooted in improper input validation (CWE‑20) and missing authorization checks (CWE‑862).

The flaw exists in Apache Polaris provided by the Apache Software Foundation. It affects any deployed instance that exposes the stage‑create endpoint to authenticated users, regardless of the specific Polaris version, as no version details were supplied.

With a CVSS score of 9.4 the vulnerability is considered critical. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attack requires an authenticated user with low privileges, who can send a stage‑create request containing a chosen storage location. By doing so, the attacker can obtain temporary credentials that grant them full access to the target storage, potentially leading to data exfiltration, modification, or deletion.