CVE-2026-16336: Trino OAuth2/OIDC Open Redirect Vulnerability

CVE-2026-16336 Overview

CVE-2026-16336 is an open redirect vulnerability [CWE-601] affecting Trino 481, the distributed SQL query engine maintained by trinodb. The flaw resides in the core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java file within the OAuth2/OIDC authentication component. Attackers can manipulate the redirect_uri argument to redirect authenticated users to attacker-controlled destinations. The issue is remotely exploitable and requires user interaction to trigger, typically through a crafted authentication URL. According to VulDB, the project was notified through an issue report but has not yet responded at the time of disclosure.

Critical Impact
Attackers can craft malicious OAuth2 authentication URLs that redirect Trino users to attacker-controlled sites, enabling phishing and credential theft campaigns against data platform operators.

Affected Products

Trino 481 (trinodb)
Component: OAuth2/OIDC authentication handler
File: core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java

Discovery Timeline

2026-07-21 - CVE CVE-2026-16336 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16336

Vulnerability Analysis

Trino is a distributed SQL query engine used to query large data sets across heterogeneous sources. Version 481 supports OAuth2 and OpenID Connect (OIDC) for user authentication, delegating login flows to external identity providers. The ExternalUriInfo class constructs URIs used during the authentication callback flow. The vulnerability arises because the redirect_uri parameter is not sufficiently validated against an allowlist of trusted destinations. An attacker who can influence this parameter can force the server to redirect users to arbitrary external URLs following an OAuth2 flow. This class of flaw is classified as URL Redirection to Untrusted Site, tracked as [CWE-601].

Root Cause

The root cause is insufficient validation of the redirect_uri argument processed by ExternalUriInfo.java. The OAuth2/OIDC handler accepts user-supplied redirect targets and incorporates them into HTTP responses without verifying that they point to a trusted host. Because the redirect is issued by a legitimate Trino server domain, browsers and users treat the initial link as trustworthy.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL pointing to a Trino instance with a manipulated redirect_uri parameter that references an attacker-controlled domain. When a victim clicks the link and completes or cancels the OAuth2 flow, the Trino server issues an HTTP redirect to the attacker's site. The attacker can then present a cloned Trino or identity provider login page to capture credentials, session tokens, or authorization codes. See GitHub Issue #29754 and VulDB CVE-2026-16336 for additional technical context.

Detection Methods for CVE-2026-16336

Indicators of Compromise

HTTP requests to Trino OAuth2 endpoints containing redirect_uri values with external, non-allowlisted hostnames.
Server access logs showing 302 responses with Location headers pointing to unexpected domains.
User reports of unexpected browser navigation after authenticating to Trino.

Detection Strategies

Review Trino coordinator access logs for OAuth2 callback URLs where the redirect_uri parameter references domains outside the organization.
Inspect reverse proxy or web application firewall (WAF) logs for anomalous redirect_uri query parameter values sent to Trino endpoints.
Correlate authentication events with subsequent outbound browser traffic to newly registered or low-reputation domains.

Monitoring Recommendations

Alert on OAuth2 authentication requests to Trino that include external redirect targets or URL-encoded protocol schemes.
Monitor for phishing indicators such as typosquatted domains mimicking your Trino coordinator hostname.
Track authentication failures and session anomalies immediately following redirect events.

How to Mitigate CVE-2026-16336

Immediate Actions Required

Restrict access to the Trino coordinator's OAuth2 endpoints to trusted network segments where feasible.
Educate users to inspect authentication URLs and avoid clicking Trino login links received from untrusted sources.
Deploy a reverse proxy or WAF rule that validates the redirect_uri query parameter against an allowlist of trusted hosts.

Patch Information

At the time of publication, no vendor patch has been released. According to VulDB, the trinodb project was notified through GitHub Issue #29754 but has not yet responded. Monitor the Trino GitHub repository for security updates and apply fixes to ExternalUriInfo.java when they become available.

Workarounds

Enforce strict redirect_uri allowlisting at the identity provider configuration to reject unregistered callback destinations.
Place Trino behind a reverse proxy configured to strip or validate the redirect_uri parameter before forwarding requests.
Consider temporarily disabling OAuth2/OIDC authentication and reverting to a stronger, non-redirect-based authentication method until a patch is available.

bash

# Example nginx rule to block external redirect_uri values
location /oauth2/ {
    if ($arg_redirect_uri !~ "^https://trino\.example\.com/") {
        return 400;
    }
    proxy_pass http://trino_coordinator;
}