A critical vulnerability in Apache Polaris allows authenticated users to perform unauthorized credential vending, leading to potential data compromise across storage environments.

This is a missing authorization and improper input validation issue where the stage-create workflow fails to perform location validation before issuing storage credentials. An authenticated attacker can supply a custom location parameter to redirect credential scope to an arbitrary, attacker-controlled target.

The ability to obtain unauthorized storage credentials poses a severe risk to data confidentiality, integrity, and availability. By manipulating the credential scope, an attacker could gain read or write access to sensitive enterprise data stored in cloud or object storage, potentially leading to unauthorized data exfiltration or destruction. The CVSS score of 9.9 reflects the high potential for total system compromise in affected environments.

Immediate Action: Update Apache Polaris to version 1.4.1 or later immediately, as this version contains the necessary validation logic to prevent unauthorized credential vending.

Proactive Monitoring: Review access logs for unusual stage-create requests or requests involving unexpected storage locations that deviate from standard architectural patterns.

Compensating Controls: Restrict access to administrative or table-creation functions to a minimal set of trusted users and ensure that storage-layer IAM policies are scoped strictly to the minimum required resources.

Public Exploit Available: Unknown.

Given the critical severity and the potential for broad unauthorized access to storage resources, administrators should prioritize updating to version 1.4.1. The risk of credential misdirection is significant in multi-tenant or distributed storage environments, and immediate remediation is necessary to ensure the integrity of the data plane.