Hi Okumin, Thanks for driving this!
Coincidentally, I came across this PR myself while looking into something for an internal use case. Ozone having STS support is news to me — not sure how I missed that; I guess I'm losing touch there! :-) I've tagged a couple of folks on the PR who have a better understanding of the HMS and REST catalog code. Hopefully, someone will be able to review it. If not, I can take a look myself, though hopefully it won't come to that! :-) On a side note, I don't think the CVEs in Polaris are all related to credential vending. There have been a few others, some of which weren't particularly easy to exploit. My understanding is that the more recent ones are mostly around edge cases in path validation. All in all, I agree that credential vending is an important feature, and we should definitely try to implement it. Maybe we can mark it as beta if we aren't very sure, and then iteratively improve it. Thanks again for driving this forward! -Ayush On Tue, 20 Oct 2026 at 19:35, Shohei Okumiya <[email protected]> wrote: > > Hi, > > I have implemented Credential Vending on our Iceberg REST Catalog in > the Hive Metastore. I'd appreciate it if you could help code reviews. > > https://github.com/apache/hive/pull/6458 > > Credential Vending is getting a lot of attention in 2026. Some > articles[1] say we lack the capability. Apache Ozone also introduced > its own Security Token Service[2]. > > The feature could introduce major security issues, as Apache Polaris > has issued multiple related CVEs. However, if we implement it safely > and add more storage providers, I believe it will be a very attractive > feature when it becomes a real movement. > > Best, > Okumin > > - [1] > https://iotdigitaltwinplm.com/iceberg-catalogs-polaris-vs-nessie-vs-unity-comparison-2026/ > - [2] > https://ozone.apache.org/docs/next/administrator-guide/operations/s3/sts/ > - [3] https://polaris.apache.org/community/security-report/
