Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

published 2026-03-29 7 mo ago modified 2026-09-10 1 mo ago also GHSA-x27p-5f68-m644 , EUVD-2026-17459

cvss: 7.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits: 0; none known

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.

Patch / fix

fixed in 2 links 1

maven io.trino:trino-iceberg 480
trino trino 480

github.com/trinodb/trino/releases/tag/480 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34214 updated 2026-06-28 cvss 6.8

trino: iceberg: Trino Iceberg Connector: Information disclosure via accessible credentials

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 7 mo ago (2026-03-31)

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	io.trino:trino-iceberg	>=439, <480	480

Affected products

trinodb trino

Classification

Weakness

CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
CWE-312 Cleartext Storage of Sensitive Information

References

github.com /trinodb/trino/security/advisories/GHSA-x27p-5f68-m644
web, vendor-advisory
github.com /trinodb/trino/releases/tag/480
web, release-notes
nvd.nist.gov /vuln/detail/CVE-2026-34214
advisory
github.com /trinodb/trino
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary