High severity7.7NVD Advisory· Published Mar 31, 2026· Updated Apr 6, 2026
CVE-2026-34214
CVE-2026-34214
Description
Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.trino:trino-icebergMaven | >= 439, < 480 | 480 |
Affected products
6- osv-coords5 versionspkg:apk/chainguard/trino-plugin-icebergpkg:apk/chainguard/trino-plugin-lakehousepkg:apk/wolfi/trino-plugin-icebergpkg:apk/wolfi/trino-plugin-lakehousepkg:maven/io.trino/trino-iceberg
< 480-r0+ 4 more
- (no CPE)range: < 480-r0
- (no CPE)range: < 480-r0
- (no CPE)range: < 480-r0
- (no CPE)range: < 480-r0
- (no CPE)range: >= 439, < 480
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-x27p-5f68-m644ghsaADVISORY
- github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-34214ghsaADVISORY
- github.com/trinodb/trino/releases/tag/480nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.