org.apache.pinot/pinot-controller vulnerabilities

Latest org.apache.pinot/pinot-controller CVEs

Newest publication first

1. CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required

   Published 2025-04-01

   Critical·CVSS 9.8 EPSS 80.2%

   Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {"username":"hack2","password":"hack","component":"CONTROLLER","role":"ADMIN",...

2. CVE-2024-39676 Apache Pinot: Unauthorized endpoint exposed sensitive information

   Published 2024-07-24

   High·CVSS 7.5 EPSS 0.85%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details: When using a request to path “/a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.