You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "rdblue (via GitHub)" <gi...@apache.org> on 2026/06/29 18:22:41 UTC
[I] Prefix-scoped credential selection uses raw string prefix matching, not URI path boundaries [iceberg]
rdblue opened a new issue, #17004:
URL: https://github.com/apache/iceberg/issues/17004
> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution.
>
> Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them.
# Summary
GCS prefix-scoped credentials use raw string prefix matching instead
of bucket and path-boundary matching.
# Affected Maven coordinates
* primary shipped client artifact: `org.apache.iceberg:iceberg-gcp`
* bundle artifact: `org.apache.iceberg:iceberg-gcp-bundle`
# Attacker prerequisites
* control over a path, prefix, batch, or file list that sits adjacent
to a legitimately scoped prefix
* ability to trigger the credential-selection or cleanup path with
that crafted input
# Impact
* A credential for `gs://bucket/foo` also matches `gs://bucket/foobar/...`.
* A credential for `gs://bucket/a` also matches `gs://bucket/abc/...`.
* This can apply the wrong OAuth token, billing project, encryption
key, or service host override to sibling paths that merely share
characters.
# Proof status
I reproduced this locally with a targeted reproducer or exploit.
The observed result matches the trigger and impact described above.
# Key source references
* org.apache.iceberg.gcp.gcs.GCSFileIO
* org.apache.iceberg.rest.responses.LoadTableResponse
* org.apache.iceberg.rest.RESTSessionCatalog
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Prefix-scoped credential selection uses raw string prefix matching, not URI path boundaries [iceberg]
Posted by "rdblue (via GitHub)" <gi...@apache.org>.
rdblue commented on issue #17004:
URL: https://github.com/apache/iceberg/issues/17004#issuecomment-4835691906
This is not a problem with the Iceberg client. It is the service's responsibility to ensure that it does not create overly-broad credentials.
I'll close this and remove the security label.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Prefix-scoped credential selection uses raw string prefix matching, not URI path boundaries [iceberg]
Posted by "rdblue (via GitHub)" <gi...@apache.org>.
rdblue closed issue #17004: Prefix-scoped credential selection uses raw string prefix matching, not URI path boundaries
URL: https://github.com/apache/iceberg/issues/17004
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org