Apache Polaris failed to consistently validate the storage location of metadata files supplied during table or view registration. The flaw allows an authenticated user with registration privileges to influence the catalog to read a metric file from an attacker‑specified location before the catalog verifies that the location is within its allowed boundaries. The accessed file can contain sensitive metadata, leading to disclosure of limited information. No integrity or availability impact has been documented.

The vulnerability affects Apache Polaris. No specific version range is provided in the CNA data, so all deployments vulnerable to this flaw should be considered impacted until an official patch is released. Users should verify their Polaris version against the vendor’s advisory to determine if they are affected.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is unknown and the flaw is not listed in CISA’s KEV catalog, so the public exploitation probability is uncertain. The attacker must be authenticated and have permission to register tables or views, and the catalog’s backing storage credentials must be able to read external objects. Under those conditions the flaw can be exploited to read data from outside the intended storage boundary, which represents a confidentiality risk. No data modification or denial‑of‑service effects have been reported.