Answer in brief
CVE-2026-34214 records a High severity (CVSS 7.7) vulnerability in Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON. The current sources do not mark it as known exploited. The current feed maps io.trino:trino-iceberg (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps io.trino:trino-iceberg (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| io.trino:trino-icebergmaven | >=439 <480 | 480 |
Published upstream
Mar 29, 2026
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
### Summary Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. ### Details Iceberg REST catalog typically needs access to object storage. This access can be configured in multiple different ways. When storage access is achieved by static credentials (e.g. AWS S3 access key) or vended credentials (temporary access key). Query JSON is a query visualization and performance troubleshooting facility. It includes serialized query plan and handles for table writes or execution of table procedures. A user that submitted a query has access to query JSON for their query. Query JSON is available from Trino UI or via `/ui/api/query/«query_id»` and `/v1/query/«query_id»` endpoints. The storage credentials are stored in those handles when performing write operations, or table maintenance operations. They are serialized in query JSON. A user with write access to data in Iceberg connector configured to use REST Catalog with static or vended credentials can retrieve those credentials. ### Impact Anyone using Iceberg REST catalog with static or vended credentials is impacted. The credentials should be considered compromised. Vended credentials are temporary in nature so they do not need to be rotated. However, underlying data could have been exposed.
Quoted source text, attributed separately from HOL analysis.