CVE-2026-34214: Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-31 · updated 2026-07-24
Weakness: CWE-212

Description

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.

Affected products

trinodb trino: from 439 before 480 — fixed in 480

How to fix

Upgrade to a fixed version: trinodb trino 480. Check the vendor advisory for mitigations.

References

https://github.com/trinodb/trino/releases/tag/480
https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644

Get alerted when CVE-2026-34214 or the next vulnerability affects your stack