Tag:Security

Articles tagged "Security".

• 31 MIN READ•Sep 21, 2026

  CVE-2026-73334 and the Trust Boundary Inside an Encrypted Parquet File

  CVE-2026-73334 lets a tampered Parquet footer route a reader's KMS token to an attacker. Here's the fix, Iceberg's safe path, and how to audit your lakehouse.

  Apache ParquetEncryptionKMS
• 31 MIN READ•Sep 21, 2026

  Keeping Lakehouse Traffic Off the Public Internet With Apache Polaris

  A private Polaris lakehouse still leaks data if the storage hop goes public. How to bind vended credentials to private networks on AWS, Azure, and GCP.

  Apache PolarisNetworkingSecurity
• 31 MIN READ•Aug 25, 2026

  Securing the Agentic Lakehouse Gateway: Preventing Prompt Injection and Data Exfiltration

  Agentic lakehouse gateways face prompt injection and exfiltration through query results. A threat model and defenses for the layer in front of data.

  AI agentssecurityMCP
• 32 MIN READ•Aug 19, 2026

  Securing the Agentic Lakehouse Gateway: A Threat Model for Prompt Injection, Exfiltration, and the Firewall That Reads Sentences

  A threat model for the agentic lakehouse gateway covering prompt injection, exfiltration, and the firewall that reads sentences.

  securityprompt injectionMCP
• 21 MIN READ•Aug 4, 2026

  Building Apache Iceberg Lakehouses That Run Without an Internet Connection

  How to build an Apache Iceberg lakehouse that runs fully offline: storage, catalog, compute, cross-zone transfer, compliance, and the failure modes that bite.

  Apache IcebergAir-GappedOn-Premises
• 21 MIN READ•Aug 4, 2026

  Cross-Cloud Credential Vending in Apache Polaris and the End of Permanent Storage Keys

  How Apache Polaris vends short-lived, prefix-scoped storage credentials across AWS, Azure, and GCP, and how to retire permanent storage keys for good.

  Apache PolarisCredential VendingSecurity
• 21 MIN READ•Aug 4, 2026

  Defending the Lakehouse Gateway Against Prompt Injection and Data Exfiltration

  Defending the lakehouse gateway against prompt injection and data exfiltration: per-user identity, no-SQL tool surfaces, volume bounds, and detection.

  AI AgentsPrompt InjectionSecurity
• 17 MIN READ•Jul 13, 2026

  Policy Layer for Autonomous AI Data Agents

  Why a prompt is not a security boundary for autonomous data agents, and how a runtime policy layer enforces query limits, egress quotas, and isolation pools.

  SecurityPolicy EnforcementMulti-Agent Systems
• 16 MIN READ•Jul 13, 2026

  REST Catalog Credential Vending for Iceberg

  How Iceberg REST catalog credential vending replaces static cloud keys with short-lived scoped credentials, what the catalog controls, and how to limit agents.

  REST CatalogSecurityCredential Vending
• 27 MIN READ•Jul 6, 2026

  File Encryption for the Lakehouse: The Terminology, the Machinery, and the Hard Problem of Interoperable Encrypted Tables

  Encryption terms, Parquet modular encryption, and Iceberg 1.11 table encryption explained, plus the problems of sharing encrypted tables across engines.

  encryptiondata lakehousesecurity
• 15 MIN READ•Jul 6, 2026

  Designing Private, Air-Gapped Data Lakehouses: Scaling Iceberg in Highly Secure, On-Premises Clouds

  How to run Iceberg lakehouses in air-gapped and on-prem clouds: storage, catalogs, engine placement, agent access, supply chain upgrades, audit, and recovery.

  air-gappeddata lakehouseiceberg
• 15 MIN READ•Jun 8, 2026

  Securing Agent Identities in the Lakehouse

  Every lakehouse agent needs its own identity, scope, and audit trail.

  lakehouseAI agentstoken exchange