Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34214Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

High 7.7

In plain English

A high-severity security flaw in trino from trinodb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 89.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.trino:trino-iceberg	480	GHSA-x27p-5f68-m644

Affected products (as reported)

Vendor	Product	Versions
trinodb	trino	>= 439, < 480

Weakness: CWE-212, CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644 x_refsource_CONFIRM
https://github.com/trinodb/trino/releases/tag/480 x_refsource_MISC