Apache Polaris lets an authenticated principal with table‑write permission set server‑side FileIO client options such as s3.endpoint in table metadata. If the table writer is not trusted, they can redirect server‑side Iceberg operations to any endpoint they choose, using credentials scoped to the operation. This enables server‑side request forgery that can expose authentication material and potentially access internal resources. The root weakness is improper input validation leading to uncontrolled outbound traffic.

The issue affects Apache Polaris versions earlier than 1.8.0 when the catalog storage configuration does not override the endpoint. Deployments where table writers are not fully trusted to configure server‑side storage endpoints are vulnerable.

The CVSS score is 8.1. The EPSS score of <1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw can be exploited by any privileged table writer with permissions to modify table metadata, the risk remains moderate to high. Credential leakage could be a foothold for further attacks, so organizations should treat the flaw as significant until a patch is applied.