CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
Apache Polaris before 1.8.0 lets authorized Iceberg table writers set FileIO endpoints in metadata, redirecting server-side requests to attacker-controlled servers.