Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73322— Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()

Quick assessment

Affected
Apache Software Foundation Apache Pinot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Pinot 的单阶段查询引擎中存在授权错误漏洞。 当启用 Broker 访问控制时，单阶段查询引擎仅对查询语句 FROM 子句中指定的表进行授权检查。然而， 转换函数通过字符串字面量参数来识别其维度表，而非通过 FROM 子句，导致该表未被纳入授权检查范围。因此，任何已认证且至少被授权访问一张表的用户，均可读取集群中任意维度表的列（包括其无权访问的表），并通过直接提供主键值来检索该表中的任意行。此外，在维度表上配置的基于主体的行级安全过滤器同样不会被应用。 多阶段查询引擎不受此问题影响。 此问题影响

AI Predicted 7.5 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
Apache Software Foundation Apache Pinot 0.7.0< 1.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73322

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so that table was never included in the authorization check. An authenticated user who is authorized for at least one table can therefore read columns from any dimension table in the cluster, including tables they have no access to, and can retrieve arbitrary rows of it by supplying primary key values directly. Per-principal row-level security filters configured on the dimension table are likewise not applied. The multi-stage query engine is not affected. This issue affects Apache Pinot: through 1.5.1 Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Pinot 0.7.0 ~ 1.6.0 -

II. Public POCs for CVE-2026-73322

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73322

请登录查看更多情报信息。

Other References for CVE-2026-73322 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-30 · 3 CVEs total

CVE-2026-64618 Apache Fineract: SQL injection vulnerability in Search API
CVE-2026-65874 Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoi

IV. Related Vulnerabilities

Same product: Apache Pinot
Same vendor: Apache Software Foundation
Same weakness: CWE-863