PT-2026-28609 · Trino · Trino

Findinpath · Published 2026-03-29 · Updated 2026-03-31 · CVE-2026-34214

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trino versions 439 through 479

Description Trino is a distributed SQL query engine for big data analytics. The Iceberg connector REST catalog allows users with write privileges to access static credentials (access key) or vended credentials (temporary access key). These credentials are stored in query JSON, accessible via the /ui/api/query/«query id» and /v1/query/«query id» API endpoints. The storage credentials are serialized in query JSON during write operations or table maintenance operations. Anyone using the Iceberg REST catalog with static or vended credentials is impacted, and the credentials should be considered compromised.

Recommendations Upgrade to version 480 or later.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-212

CWE-312

Related Identifiers

CVE-2026-34214

GHSA-X27P-5F68-M644

Affected Products

Trino

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34214.json · Exploit
• https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x27p-5f68-m644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34214 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34214 · Vendor Advisory
• https://github.com/trinodb/trino/releases/tag/480 · Note
• https://github.com/trinodb/trino · Note
• https://reddit.com/r/VulnMatter/comments/1s7p447/resumen_diario_de_vulnerabilidades_30032026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1s7p44p/resumen_diario_de_vulnerabilidades_30032026 · Reddit Post
• https://twitter.com/CVEnew/status/2039004435272073497 · Twitter Post