Apache Pinot vulnerabilities

Latest Apache Pinot CVEs

Newest publication first

1. CVE-2026-73322 Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()

   Published 2026-10-30

   Medium·CVSS 6.5

   Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table...

2. CVE-2022-26112 Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support

   Published 2022-09-23

   Critical·CVSS 9.8

   In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. S...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.