CVE-2016-10321

What it actually does

The authentication logic skips host denylist enforcement and proceeds directly to password verification, enabling unlimited authentication attempts against valid accounts.

Why it matters to the business

Attackers can systematically guess credentials on exposed services, increasing the likelihood of account takeover and unauthorized data access across deployments that have not applied the update.

How an attack unfolds

An attacker identifies a reachable authentication endpoint, issues repeated login attempts using guessed or enumerated credentials, and bypasses the intended host-restriction check because it occurs after password validation begins.

How to fix it

Upgrade all listed packages to the fixed versions provided: trino, trino-config, trino-oci-entrypoint, and each trino-plugin-* package to 444-r1 (Chainguard and Wolfi variants). Remove or isolate any remaining instances running versions prior to 2.14.6 equivalent.

How to confirm the fix worked

Confirm package versions match or exceed the listed fixed releases; review authentication configuration files to ensure host denylist checks occur before password verification; run integration tests that simulate denied-host login attempts.

Typical attack path

1. Locate an exposed authentication endpoint on an unpatched instance
2. Enumerate or guess usernames through error responses or timing
3. Submit high-volume credential guesses from a single or rotating source IP
4. Obtain valid credentials once rate limiting or host blocks are never triggered
5. Use obtained credentials for further lateral movement or data access

How to detect it

Search authentication and application logs for unusually high numbers of failed login attempts originating from the same IP addresses or subnets over short time windows; correlate with any successful authentications that follow such patterns.

What your security team should do

• Immediately schedule upgrades to the 444-r1 releases for all affected Trino packages
• Enable network-level rate limiting and IP reputation filtering in front of authentication endpoints until patches are deployed
• Audit authentication logs for anomalous volumes of failed attempts from single sources
• Review and tighten host denylist rules in application configuration post-upgrade