This vulnerability allows users who have write privilege on SQL queries to read the REST catalog configuration of the Iceberg connector in Trino. The configuration contains either a static access key or a temporary, vended access key. An attacker who can submit a write query can therefore obtain the key through the JSON returned by the query. The stolen key can give the attacker unauthorized access to the underlying data lake or cloud storage, enabling data exfiltration or further compromise of the platform. The weakness is represented by CWE‑212 and CWE‑312.

Trino, the distributed SQL engine from Trinodb. The affected product is the Iceberg connector’s REST catalog configuration. Versions starting from 439 up to but not including 480 are vulnerable. All deployments relying on these versions carry the risk.

The CVSS score is 7.7, indicating a high potential impact. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild today, and the vulnerability has not been identified in the CISA KEV catalog. The likely attack vector requires that the attacker can execute write‑level SQL queries within the Trino environment. If such privileges exist, credential disclosure is straightforward, making remediation a priority.