Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by trinodb
CVE-2026-16336 (GCVE-0-2026-16336)
Vulnerability from nvd – Published: 2026-07-21 02:30 – Updated: 2026-07-21 13:23
VLAI
EPSS
VEX
Title
trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect
Summary
A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirect_uri results in open redirect. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - Open Redirect
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380710 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380710/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16336 | third-party-advisory |
| https://vuldb.com/submit/858687 | third-party-advisory |
| https://github.com/trinodb/trino/issues/29754 | issue-tracking |
| https://github.com/trinodb/trino/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16336",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T13:23:22.554507Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T13:23:59.700Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:trinodb:trino:*:*:*:*:*:*:*:*"
],
"modules": [
"OAuth2/OIDC"
],
"product": "trino",
"vendor": "trinodb",
"versions": [
{
"status": "affected",
"version": "481"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0Xrry (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirect_uri results in open redirect. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:30:09.393Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380710 | trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380710"
},
{
"name": "VDB-380710 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380710/cti"
},
{
"name": "CVE-2026-16336 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16336"
},
{
"name": "Submit #858687 | GitHub trino 481 Open Redirect",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/858687"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/trinodb/trino/issues/29754"
},
{
"tags": [
"product"
],
"url": "https://github.com/trinodb/trino/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-20T20:11:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16336",
"datePublished": "2026-07-21T02:30:09.393Z",
"dateReserved": "2026-07-20T18:06:42.878Z",
"dateUpdated": "2026-07-21T13:23:59.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34214 (GCVE-0-2026-34214)
Vulnerability from nvd – Published: 2026-03-31 14:14 – Updated: 2026-03-31 14:28
VLAI
EPSS
VEX
Title
Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON
Summary
Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/trinodb/trino/security/advisor… | x_refsource_CONFIRM |
| https://github.com/trinodb/trino/releases/tag/480 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34214",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-31T14:28:47.033694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-31T14:28:53.287Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "trino",
"vendor": "trinodb",
"versions": [
{
"status": "affected",
"version": "\u003e= 439, \u003c 480"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312: Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-31T14:14:47.982Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644"
},
{
"name": "https://github.com/trinodb/trino/releases/tag/480",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/trinodb/trino/releases/tag/480"
}
],
"source": {
"advisory": "GHSA-x27p-5f68-m644",
"discovery": "UNKNOWN"
},
"title": "Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34214",
"datePublished": "2026-03-31T14:14:47.982Z",
"dateReserved": "2026-03-26T15:57:52.324Z",
"dateUpdated": "2026-03-31T14:28:53.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16336 (GCVE-0-2026-16336)
Vulnerability from cvelistv5 – Published: 2026-07-21 02:30 – Updated: 2026-07-21 13:23
VLAI
EPSS
VEX
Title
trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect
Summary
A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirect_uri results in open redirect. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - Open Redirect
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380710 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380710/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16336 | third-party-advisory |
| https://vuldb.com/submit/858687 | third-party-advisory |
| https://github.com/trinodb/trino/issues/29754 | issue-tracking |
| https://github.com/trinodb/trino/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16336",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T13:23:22.554507Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T13:23:59.700Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:trinodb:trino:*:*:*:*:*:*:*:*"
],
"modules": [
"OAuth2/OIDC"
],
"product": "trino",
"vendor": "trinodb",
"versions": [
{
"status": "affected",
"version": "481"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0Xrry (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirect_uri results in open redirect. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T02:30:09.393Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380710 | trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380710"
},
{
"name": "VDB-380710 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380710/cti"
},
{
"name": "CVE-2026-16336 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16336"
},
{
"name": "Submit #858687 | GitHub trino 481 Open Redirect",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/858687"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/trinodb/trino/issues/29754"
},
{
"tags": [
"product"
],
"url": "https://github.com/trinodb/trino/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-20T20:11:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16336",
"datePublished": "2026-07-21T02:30:09.393Z",
"dateReserved": "2026-07-20T18:06:42.878Z",
"dateUpdated": "2026-07-21T13:23:59.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34214 (GCVE-0-2026-34214)
Vulnerability from cvelistv5 – Published: 2026-03-31 14:14 – Updated: 2026-03-31 14:28
VLAI
EPSS
VEX
Title
Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON
Summary
Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/trinodb/trino/security/advisor… | x_refsource_CONFIRM |
| https://github.com/trinodb/trino/releases/tag/480 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34214",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-31T14:28:47.033694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-31T14:28:53.287Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "trino",
"vendor": "trinodb",
"versions": [
{
"status": "affected",
"version": "\u003e= 439, \u003c 480"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312: Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-31T14:14:47.982Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644"
},
{
"name": "https://github.com/trinodb/trino/releases/tag/480",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/trinodb/trino/releases/tag/480"
}
],
"source": {
"advisory": "GHSA-x27p-5f68-m644",
"discovery": "UNKNOWN"
},
"title": "Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34214",
"datePublished": "2026-03-31T14:14:47.982Z",
"dateReserved": "2026-03-26T15:57:52.324Z",
"dateUpdated": "2026-03-31T14:28:53.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}