You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "rdblue (via GitHub)" <gi...@apache.org> on 2026/05/20 21:33:28 UTC
[I] `IcebergGenerics` can leak unrequested columns and metadata when deletes are applied [iceberg]
rdblue opened a new issue, #16474:
URL: https://github.com/apache/iceberg/issues/16474
> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution.
>
> Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them.
# Summary
When delete processing is active, `IcebergGenerics` widens the read
schema and returns the widened records directly instead of
reprojecting to the caller’s requested columns.
# Affected Maven coordinates
* primary shipped client artifact: `org.apache.iceberg:iceberg-data`
# Attacker prerequisites
* access to the affected metadata, table-option, or row-return surface
* a deployment where that surface is visible to callers who are not
meant to receive the widened data or secret set
# Impact
* Confidentiality breach for any service or library layer that treats
`select(...)` or `project(...)` as a boundary for what data is exposed
downstream.
* Particularly risky in multi-tenant services, data-serving APIs, or
pipelines that intentionally avoid pulling sensitive columns into
memory.
# Proof status
Source review only. The issue is visible directly from source.
# Key source references
* org.apache.iceberg.data.GenericReader
* org.apache.iceberg.data.DeleteFilter
Current severity assessment [2]: Important
[1] https://iceberg.apache.org/security/
[2] https://security.apache.org/blog/severityrating/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] `IcebergGenerics` can leak unrequested columns and metadata when deletes are applied [iceberg]
Posted by "RussellSpitzer (via GitHub)" <gi...@apache.org>.
RussellSpitzer closed issue #16474: `IcebergGenerics` can leak unrequested columns and metadata when deletes are applied
URL: https://github.com/apache/iceberg/issues/16474
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] `IcebergGenerics` can leak unrequested columns and metadata when deletes are applied [iceberg]
Posted by "RussellSpitzer (via GitHub)" <gi...@apache.org>.
RussellSpitzer commented on issue #16474:
URL: https://github.com/apache/iceberg/issues/16474#issuecomment-4502984810
select() is project-up by design; not an authorization boundary
This is explicitly noted in the Java doc that filters will bring in other columns required for filters
https://github.com/apache/iceberg/blob/866d50e368e8b6382d25a59457a6936aded39867/api/src/main/java/org/apache/iceberg/Scan.java#L96-L115
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] `IcebergGenerics` can leak unrequested columns and metadata when deletes are applied [iceberg]
Posted by "rdblue (via GitHub)" <gi...@apache.org>.
rdblue commented on issue #16474:
URL: https://github.com/apache/iceberg/issues/16474#issuecomment-4503557908
I agree with @RussellSpitzer. I should also add that whatever calls this still has to read the data files, which contain all of the columns anyway. This doesn't impact security.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org