CVE-2026-34214 Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON
Users with SQL write privileges can access Iceberg REST catalog static or vended credentials via query JSON, exposing sensitive authentication keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34214?
CVE-2026-34214 is a high-severity vulnerability in trinodb trino, published on 31 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.
Which versions are affected by CVE-2026-34214?
2 open source packages ship an affected version, including io.trino:trino-iceberg. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.trino:trino-iceberg Maven | From 439 | 480 |
io.trino:trino-iceberg Maven | From 439 | 480 |
Products include Trino Trino.
How do I fix CVE-2026-34214?
Upgrade io.trino:trino-iceberg to 480 or later.
Is CVE-2026-34214 being exploited?
There is no known exploitation of CVE-2026-34214 in the wild and no public exploit code.
Sources
Also known as GHSA-x27p-5f68-m644.