CVE-2026-64640: Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

<p>Posted by Alexandre Dutra on Aug 06</p>Severity: low <br /> <br /> Affected versions:<br /> <br /> - Apache Polaris (org.apache.polaris:polaris-runtime-service) through 1.6.0<br /> <br /> Description:<br /> <br /> Apache Polaris did not consistently validate storage locations supplied during table and view registration.<br /> <br /> An authenticated principal with permission to register a table