You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "rdblue (via GitHub)" <gi...@apache.org> on 2026/05/20 21:33:40 UTC
[I] Maintenance locks are not owner-bound and can be cleared by another job [iceberg]
rdblue opened a new issue, #16477:
URL: https://github.com/apache/iceberg/issues/16477
> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution.
>
> Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them.
# Summary
Flink maintenance locks can be cleared by another job because unlock
paths do not verify ownership tokens.
# Affected Maven coordinates
* versioned integration artifacts:
`org.apache.iceberg:iceberg-flink-1.20`,
`org.apache.iceberg:iceberg-flink-2.0`,
`org.apache.iceberg:iceberg-flink-2.1`
# Attacker prerequisites
* ability to call the affected maintenance, DDL, or cleanup path
* a deployment where that caller should not be able to target the
broader resource set that the current code allows
# Impact
* A second job instance can clear a live maintenance or recovery lock
that belongs to another job.
* That undermines the lock's integrity guarantees and can permit
overlapping maintenance actions such as orphan-file deletion, snapshot
expiration, or rewrite tasks.
* The resulting failure mode is integrity loss, not just availability loss.
# Proof status
Source review only. The issue is visible directly from source.
# Key source references
* org.apache.iceberg.flink.maintenance.operator.TriggerManager
* org.apache.iceberg.flink.maintenance.api.JdbcLockFactory
* org.apache.iceberg.flink.maintenance.api.ZkLockFactory
* org.apache.iceberg.flink.maintenance.operator.LockRemover
Current severity assessment [2]: Important
[1] https://iceberg.apache.org/security/
[2] https://security.apache.org/blog/severityrating/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Maintenance locks are not owner-bound and can be cleared by another job [iceberg]
Posted by "rdblue (via GitHub)" <gi...@apache.org>.
rdblue commented on issue #16477:
URL: https://github.com/apache/iceberg/issues/16477#issuecomment-4503597183
This requires write access to the table and is the intended behavior of the locks, so that someone with write access to the table can clear out deadlocks. Deadlocking is the more serious concern, and someone with write access can do more damage than undermining integrity guarantees to permit overlapping maintenance actions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Maintenance locks are not owner-bound and can be cleared by another job [iceberg]
Posted by "rdblue (via GitHub)" <gi...@apache.org>.
rdblue closed issue #16477: Maintenance locks are not owner-bound and can be cleared by another job
URL: https://github.com/apache/iceberg/issues/16477
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Maintenance locks are not owner-bound and can be cleared by another job [iceberg]
Posted by "RussellSpitzer (via GitHub)" <gi...@apache.org>.
RussellSpitzer commented on issue #16477:
URL: https://github.com/apache/iceberg/issues/16477#issuecomment-4504114613
I would agree, overlapping maintenance jobs really can't be a security issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org