NextGuard
UNKNOWNCVE-2026-34214

Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Platform

java

Component

trino

Fixed in

480

View on NVD

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.

How to fix

Actualice Trino a la versión 480 o superior. Esta versión corrige la vulnerabilidad que permite el acceso no autorizado a las credenciales de Iceberg REST catalog a través de consultas JSON.

Monitor your dependencies automatically

Get notified when new vulnerabilities affect your projects. Free forever.

Start free