A vulnerability in the Trino Iceberg connector allows authenticated users with write privileges to access sensitive storage credentials, posing a significant risk of unauthorized data exposure.

This flaw involves the improper storage and transfer of sensitive information within the Iceberg connector, where both static and vended temporary access keys remain accessible to any user possessing SQL write privileges. The attack requires the user to be authenticated with standard write access to the SQL interface.

The exposure of storage access keys grants attackers the ability to bypass intended data access controls, potentially leading to unauthorized data exfiltration or manipulation of big data assets stored in external systems. Given the CVSS score of 7.7, this is a high severity issue that could result in significant data breaches and compromise the integrity of the organization's analytics environment.

Immediate Action: Upgrade to Trino version 480 or later, which contains the necessary security patches to restrict credential access.

Proactive Monitoring: Audit database access logs for unusual queries executed by users with write privileges that may indicate attempts to probe or extract metadata related to Iceberg connector configurations.

Compensating Controls: Implement strict role based access control (RBAC) policies within the Trino environment to limit the number of users granted write privileges until the patch is successfully deployed.

Public Exploit Available: No

This vulnerability presents a clear risk to sensitive cloud storage credentials and requires immediate attention. Administrators must prioritize updating all affected Trino instances to version 480 to eliminate the exposure of these credentials to unauthorized users.