Skip to content

Commit 8c848ba

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-wp76-gg32-8258 GHSA-x27p-5f68-m644
1 parent 859baab commit 8c848ba

2 files changed

Lines changed: 146 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-wp76-gg32-8258/GHSA-wp76-gg32-8258.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wp76-gg32-8258",
4+
"modified": "2026-03-29T15:14:03Z",
5+
"published": "2026-03-29T15:14:03Z",
6+
"aliases": [
7+
"CVE-2026-34215"
8+
],
9+
"summary": "Parse Server exposes auth data via verify password endpoint",
10+
"details": "### Impact\n\nThe verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection.\n\n### Patches\n\nThe verify password endpoint now sanitizes authentication data through auth adapter hooks before returning the response, consistent with login and user retrieval endpoints.\n\n### Workarounds\n\nThere is no known workaround.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0"
29+
},
30+
{
31+
"fixed": "9.7.0-alpha.7"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.63"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-wp76-gg32-8258"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/parse-community/parse-server/pull/10323"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/pull/10324"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/parse-community/parse-server"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-200"
78+
],
79+
"severity": "HIGH",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-03-29T15:14:03Z",
82+
"nvd_published_at": null
83+
}
84+
}

‎advisories/github-reviewed/2026/03/GHSA-x27p-5f68-m644/GHSA-x27p-5f68-m644.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x27p-5f68-m644",
4+
"modified": "2026-03-29T15:13:30Z",
5+
"published": "2026-03-29T15:13:30Z",
6+
"aliases": [
7+
"CVE-2026-34214"
8+
],
9+
"summary": "Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON",
10+
"details": "### Summary\n\nIceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level.\n\n### Details\n\nIceberg REST catalog typically needs access to object storage. This access can be configured in multiple different ways. When storage access is achieved by static credentials (e.g. AWS S3 access key) or vended credentials (temporary access key).\n\nQuery JSON is a query visualization and performance troubleshooting facility. It includes serialized query plan and handles for table writes or execution of table procedures. A user that submitted a query has access to query JSON for their query. Query JSON is available from Trino UI or via `/ui/api/query/«query_id»` and `/v1/query/«query_id»` endpoints.\n\nThe storage credentials are stored in those handles when performing write operations, or table maintenance operations. They are serialized in query JSON. A user with write access to data in Iceberg connector configured to use REST Catalog with static or vended credentials can retrieve those credentials.\n\n### Impact\n\nAnyone using Iceberg REST catalog with static or vended credentials is impacted.\nThe credentials should be considered compromised. \nVended credentials are temporary in nature so they do not need to be rotated. However, underlying data could have been exposed.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "io.trino:trino-iceberg"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "439"
29+
},
30+
{
31+
"fixed": "480"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/trinodb/trino/security/advisories/GHSA-x27p-5f68-m644"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/trinodb/trino"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/trinodb/trino/releases/tag/480"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-212",
55+
"CWE-312"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-03-29T15:13:30Z",
60+
"nvd_published_at": null
61+
}
62+
}

0 commit comments

Comments
 (0)