PT-2026-28609 · Trino · Trino

Findinpath · Publicado 2026-03-29 · Atualizado 2026-03-31 · CVE-2026-34214

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trino versions 439 through 479

Description Trino is a distributed SQL query engine for big data analytics. The Iceberg connector REST catalog allows users with write privileges to access static credentials (access key) or vended credentials (temporary access key). These credentials are stored in query JSON, accessible via the /ui/api/query/«query id» and /v1/query/«query id» API endpoints. The storage credentials are serialized in query JSON during write operations or table maintenance operations. Anyone using the Iceberg REST catalog with static or vended credentials is impacted, and the credentials should be considered compromised.

Recommendations Upgrade to version 480 or later.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-212

CWE-312

Identificadores relacionados

CVE-2026-34214

GHSA-X27P-5F68-M644

Produtos afetados

Trino

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34214.json · Exploit
• https://github.com/trinodb/trino/releases/tag/480 · Nota
• https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644 · Aviso do Fabricante
• https://github.com/trinodb/trino · Nota
• https://osv.dev/vulnerability/GHSA-x27p-5f68-m644 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34214 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-34214 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1s7p447/resumen_diario_de_vulnerabilidades_30032026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1s7p44p/resumen_diario_de_vulnerabilidades_30032026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2039004435272073497 · Publicação no Twitter