CVE-2026-34214 Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. This issue has been patch...

CVE-2026-34214 Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. This issue has been patch...

CVE-2026-34214

Trino’s Iceberg REST catalog vulnerability (CVE-2026-34214) affects versions 439–479, where static or vended credentials used by the Iceberg REST catalog could be accessed by users with SQL write privileges via query JSON. The issue has been patched in version 480. Affected users should upgrade t...

EUVD-2026-17459

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. This issue has been patch...

CVE-2026-34214 Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. This issue has been patch...

io.github.jordepic:dataharness-trino (>=1.0, <=2.0) potentially affected by CVE-2026-34214 via io.trino:trino-iceberg (476)

io.trino:trino-iceberg MAVEN version 476 is affected by a known vulnerability. The following packages have a transitive dependency on io.trino:trino-iceberg and may be impacted: - io.github.jordepic:dataharness-trino =1.0, =2.0 Source cves: CVE-2026-34214 Source advisory: MEND:CVE-2026-34214...

CVE-2026-34214: Improper Removal of Sensitive Information Before Storage or Transfer

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. This issue has been patch...

Trino security vulnerabilities

Trino is a distributed SQL query engine developed by Trino in open source. There were security vulnerabilities in versions 439 to 480 of Trino. These vulnerabilities stemmed from static or temporary credentials in the Iceberg connector’s REST directory, which could be accessed by users with...

io.github.jordepic:dataharness-trino (>=1.0, <=2.0) potentially affected by CVE-2026-34214 via io.trino:trino-iceberg (476)

io.trino:trino-iceberg MAVEN version 476 is affected by a known vulnerability. The following packages have a transitive dependency on io.trino:trino-iceberg and may be impacted: - io.github.jordepic:dataharness-trino =1.0, =2.0 Source cves: CVE-2026-34214 Source advisory: SNYK:JAVA-IOTRINO-158571...

io.github.jordepic:dataharness-trino (>=1.0, <=2.0) potentially affected by CVE-2026-34214 via io.trino:trino-iceberg (476)

io.trino:trino-iceberg MAVEN version 476 is affected by a known vulnerability. The following packages have a transitive dependency on io.trino:trino-iceberg and may be impacted: - io.github.jordepic:dataharness-trino =1.0, =2.0 Source cves: CVE-2026-34214 Source advisory: GHSA-X27P-5F68-M644...

io.github.jordepic:dataharness-trino (>=1.0, <=2.0) potentially affected by CVE-2026-34214 via io.trino:trino-iceberg (476)

io.trino:trino-iceberg MAVEN version 476 is affected by a known vulnerability. The following packages have a transitive dependency on io.trino:trino-iceberg and may be impacted: - io.github.jordepic:dataharness-trino =1.0, =2.0 Source cves: CVE-2026-34214 Source advisory: OSV:GHSA-X27P-5F68-M644...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via /ui/api/query/«queryid» and /v1/query/«queryid» endpoints. An attacker can obtain sensitive credentials by accessing the serialized query JSON after performing wri...

Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Summary Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. Details Iceberg REST catalog typically needs access to object storage. This access can be configured in multiple differen...

GHSA-X27P-5F68-M644 Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Summary Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. Details Iceberg REST catalog typically needs access to object storage. This access can be configured in multiple differen...

PT-2026-28609

Summary Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. Details Iceberg REST catalog typically needs access to object storage. This access can be configured in multiple differen...

MAL-2026-2152 Malicious code in target-iceberg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95793a2b88fbc5bdaa5d42387e7472b796fe34c61959909a928f534137c101d9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in target-iceberg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95793a2b88fbc5bdaa5d42387e7472b796fe34c61959909a928f534137c101d9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

iceberg-dsl (>=0.0.6, <=0.1.2) potentially affected by CVE-2025-27363 via skia-python (87.5.0)

skia-python PYPI version 87.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on skia-python and may be impacted: - iceberg-dsl =0.0.6, =0.1.2 Source cves: CVE-2025-27363 Source advisory: OSV:GHSA-2MHW-8QCG-GR96...

com.codbex.atlas:codbex-atlas-application (>=2.2.0, <=2.10.0), com.codbex.hades:codbex-hades-application (>=2.2.0, <=2.10.0) +15 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.23.0)

net.snowflake:snowflake-jdbc MAVEN version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0, =2.2.0, =11.5.0,...

io.trino:trino-iceberg (>=454, <=456), io.trino:trino-snowflake (>=454, <=456) +7 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.18.0)

net.snowflake:snowflake-jdbc MAVEN version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.trino:trino-iceberg =454, =454, =2.2.1, =10.6.19, =0.1.0, =16.22.1, =16.22.1, =16.22.1, =16.22.1,...