CVE-2026-34214
High · 7.7CVSS
7.7
EPSS
0.2%
Published
Mar 31, 2026
CISA due date
—
The record
Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | trino-plugin-iceberg | 0 | 480-r0 |
| Chainguard | trino-plugin-lakehouse | 0 | 480-r0 |
| Wolfi | trino-plugin-iceberg | 0 | 480-r0 |
| Wolfi | trino-plugin-lakehouse | 0 | 480-r0 |
Related vulnerabilities
- CVE-2026-33871 Netty is an asynchronous, event-driven network application framework. Also affects trino-plugin-iceberg
- CVE-2026-33870 Netty is an asynchronous, event-driven network application framework. Also affects trino-plugin-iceberg
- CVE-2026-1225 ACE vulnerability in configuration file processing by QOS.CH logback-core up to and… Also affects trino-plugin-iceberg
- CVE-2025-67721 Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression… Also affects trino-plugin-iceberg
- CVE-2025-11226 ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up… Also affects trino-plugin-iceberg
- CVE-2024-57699 A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. Also affects trino-plugin-iceberg
- CVE-2024-12801 Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to… Also affects trino-plugin-iceberg
- CVE-2024-12798 ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version… Also affects trino-plugin-iceberg