Apache Polaris builds short‑lived GCS credentials by assembling a Credential Access Boundary that includes CEL conditions restricting access to a specific table’s storage path, but the code concatenates the bucket name with a table path derived from unescaped namespace and table identifiers. A crafted identifier containing a single quote or other CEL fragments can break out of the intended quoted string and alter the CEL logic, causing the access boundary to lose its path restriction and grant the delegated credentials full bucket access. This allows an attacker to list, read, create, and delete objects across any prefix in the configured bucket, including unrelated data and metadata.

Apache Polaris, distributed by the Apache Software Foundation, is the affected product. No specific version information is supplied in the CVE data, so all released versions may be vulnerable until a patch is applied.

The CVSS base score of 9.4 classifies the flaw as critical; EPSS is not available, and it is not listed in CISA’s KEV catalog. The likely attack vector is by an actor that can provide a malicious namespace or table identifier to Polaris—such as through an API that creates or modifies tables—after which the attacker receives GCS credentials whose path restriction collapses, enabling broad access to the bucket. No additional privileges beyond the ability to submit the identifier are required, making the exploit feasible in environments where table creation or naming is exposed.