S3 — PoC Archivehttps://poc.intelseclab.com/tags/s3/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000Apache Polaris — Cross-Tenant Credential Vending Before Location Validation in Iceberg REST Register (CVE-2026-64640)https://poc.intelseclab.com/pocs/cloud/2026-08-09_cve-2026-64640-apache-polaris-cross-tenant-credential-vending/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-08-09_cve-2026-64640-apache-polaris-cross-tenant-credential-vending/High severity (CVSS 8.1) — cloud · CVE-2026-64640. Status: Patched. Affects: Apache Polaris (Apache Iceberg REST catalog), registerTable and registerView endpoints. Tags: apache-polaris, iceberg, apache-iceberg, credential-vending, confused-deputy, authorization-bypass, cross-tenant, s3, storage, allowed-locations, CWE-441, CWE-639, CWE-918, ssrf, server-side-read, information-disclosure, register-table, register-view.cloudHighapache-polarisicebergapache-icebergcredential-vendingconfused-deputyauthorization-bypasscross-tenants3storageallowed-locationsCWE-441CWE-639CWE-918ssrfserver-side-readinformation-disclosureregister-tableregister-viewRustFS — Presigned POST Policy Condition Bypass (CVE-2026-27607)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-27607-rustfs-presigned-post-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-27607-rustfs-presigned-post-bypass/High severity — cloud · CVE-2026-27607 (GHSA-w5fh-f8xh-5x3p). Status: PoC. Affects: RustFS (S3-compatible object storage server). Tags: rustfs, s3, object-storage, presigned-url, policy-bypass, aws-sdk, cloud-storage.cloudHighrustfss3object-storagepresigned-urlpolicy-bypassaws-sdkcloud-storage