TI-2026-26509 Aliases CVE-2026-34214 GHSA-x27p-5f68-m644

Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

LOW 33CWE-212Published 2026-03-31 · Updated 2026-03-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312.

Summary

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00203 10th percentileScored 2026-11-07

Fix Fixed trino (trinodb): 480io.trino:trino-iceberg (Maven): 480

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
trinodb	trino	439 to before 480	480	Patch available	CNA
—	io.trino:trino-iceberg (Maven)	439 to before 480	480	Patch available	GHSA-x27p-5f68-m644

trino Vendortrinodb Affected 439 to before 480 Fixed in 480 Patch available CNA
io.trino:trino-iceberg (Maven) Vendor— Affected 439 to before 480 Fixed in 480 Patch available GHSA-x27p-5f68-m644

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:trino:trino::::::::	439 to before 480	Vulnerable	Trino

cpe:2.3:a:trino:trino:*:*:*:*:*:*:*:* Versions 439 to before 480 Vulnerable ·Trino

Remediation

Fix · CNA trino (trinodb) Fixed in 480
Fix · GHSA-x27p-5f68-m644 io.trino:trino-iceberg (Maven) Fixed in 480 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-34214
2026-10-03 Alias added: GHSA-x27p-5f68-m644

References

Advisory 2

Other 2

TI-2026-13650 trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences