CVE-2026-34214CWE-212CWE-312

Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

High · published March 31, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weaknesses
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer; CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-03-31T14:14Z
EPSS history
Timeline
  • 31 MAR 14:14Z
    Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON
    cvelistv5