Vulnerabilities in pkg:maven/io.trino/trino-iceberg

PACKAGE
Advisory Identifier: GHSA-x27p-5f68-m644
Share
Advisory Summary

CVE-2026-34214 is a HIGH (CVSS 7.7) iceberg rest catalog static and vulnerability (CWE-312: Cleartext Storage of Sensitive Information) affecting Trino libraries in the Maven ecosystem. The issue involves iceberg rest catalog static and vended credentials are accessible via query json. Remediation is available by upgrading affected packages to version 480.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:maven/io.trino/trino-iceberg

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/io.trino/trino-iceberg. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-x27p-5f68-m644 CVE-2026-34214 HIGH Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

CVE-2026-34214 at a Glance

CVE Identifier CVE-2026-34214
GHSA Identifier GHSA-x27p-5f68-m644
Severity HIGH
CVSS v3.1 Base Score 7.7
CWE Classification CWE-312: Cleartext Storage of Sensitive Information
Affected Product Trino
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2026-34214

To remediate this vulnerability, upgrade all affected Trino dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

io.trino:trino-iceberg fixed: 480 
<dependency>
    <groupId>io.trino</groupId>
    <artifactId>trino-iceberg</artifactId>
    <version>480</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=io.trino

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-34214, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=io.trino

Analyze the terminal output to locate any version of Trino in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 480), your application is affected.

Note: The mvn dependency:tree -Dincludes=io.trino command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-312: Cleartext Storage of Sensitive Information, where the product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. In Trino, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. ### Details Iceberg REST catalog typically needs access to object storage. This access can be configured in multiple different ways. When storage access is achieved by static credentials (e.g. AWS S3 access key) or vended credentials (temporary access key). Query JSON is a query visualization and performance troubleshooting facility. It includes serialized query plan and handles for table writes or execution of table procedures. A user that submitted a query has access to query JSON for their query. Query JSON is available from Trino UI or via `/ui/api/query/«query_id»` and `/v1/query/«query_id»` endpoints. The storage credentials are stored in those handles when performing write operations, or table maintenance operations. They are serialized in query JSON. A user with write access to data in Iceberg connector configured to use REST Catalog with static or vended credentials can retrieve those credentials. ### Impact Anyone using Iceberg REST catalog with static or vended credentials is impacted. The credentials should be considered compromised. Vended credentials are temporary in nature so they do not need to be rotated. However, underlying data could have been exposed.

CVE-2026-34214 Affected Trino Versions

1 component(s)
Fixed Versions:
480
Product / Package Ecosystem Affected Versions Fixed Version
io.trino:trino-iceberg
maven/io.trino/trino-iceberg
Maven
≥ 439
< 480
480

References

GitHub Advisory / Wiki ADVISORY
https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644
NVD — CVE-2026-34214 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34214
Trino Source Repository REPOSITORY
https://github.com/trinodb/trino
Trino Release RELEASE
https://github.com/trinodb/trino/releases/tag/480

Frequently Asked Questions

What is CVE-2026-34214?
CVE-2026-34214 is a security vulnerability in Trino involving Iceberg REST catalog static and vended credentials are accessible via query JSON under CWE-312: Cleartext Storage of Sensitive Information.
Which Trino versions are affected?
Affected versions include releases prior to 480 across affected packages: io.trino:trino-iceberg.
What version fixes CVE-2026-34214?
Upgrading to 480 (or the latest patched release for your respective branch) resolves the vulnerability.
Is trino-iceberg affected?
Yes, io.trino:trino-iceberg is affected in releases prior to 480. Upgrade your dependency to 480 or later.
What is the CVSS score of CVE-2026-34214?
CVE-2026-34214 has a CVSS v3.1 base score of 7.7 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
What CWE is associated with CVE-2026-34214?
CVE-2026-34214 is classified under CWE-312: Cleartext Storage of Sensitive Information (The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.).
How can I check Maven dependencies for CVE-2026-34214?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.trino'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x27p-5f68-m644",
  "modified" : "2026-03-31T18:51:27Z",
  "published" : "2026-03-29T15:13:30Z",
  "aliases" : [ "CVE-2026-34214" ],
  "summary" : "Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON",
  "details" : "### Summary\n\nIceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level.\n\n### Details\n\nIceberg REST catalog typically needs access to object storage. This access can be configured in multiple different ways. When storage access is achieved by static credentials (e.g. AWS S3 access key) or vended credentials (temporary access key).\n\nQuery JSON is a query visualization and performance troubleshooting facility. It includes serialized query plan and handles for table writes or  execution of table procedures. A user that submitted a query has access to query JSON for their query. Query JSON is available from Trino UI or via `/ui/api/query/«query_id»` and `/v1/query/«query_id»` endpoints.\n\nThe storage credentials are stored in those handles when performing write operations, or table maintenance operations. They are serialized in query JSON. A user with write access to data in Iceberg connector configured to use REST Catalog with static or vended credentials can retrieve those credentials.\n\n### Impact\n\nAnyone using Iceberg REST catalog with static or vended credentials is impacted.\nThe credentials should be considered compromised. \nVended credentials are temporary in nature so they do not need to be rotated. However, underlying data could have been exposed.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.trino:trino-iceberg"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "439"
      }, {
        "fixed" : "480"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34214"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/trinodb/trino"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trinodb/trino/releases/tag/480"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-212", "CWE-312" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-29T15:13:30Z",
    "nvd_published_at" : "2026-03-31T15:16:18Z"
  }
}