Apache Pinot before 1.6.0 can read unauthorized tables (CVE-2026-73322)
Original title: CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
With broker access control on, lookup() can name a dimension table that the FROM-clause check never authorizes.
Apache Pinot 0.7.0 before 1.6.0 has an incorrect-authorization flaw in the single-stage query engine, rated moderate. When broker access control is enabled, only the table in the query FROM clause is authorized. The lookup() transform takes its dimension table as a string literal, so that table can be read without the same check. The oss-security note was posted by Yash Mayya on October 30.
Unconfirmed: The feed snippet cuts off before any exploit status or full fix notes.
- Severity is listed as moderate.
- Affected range is Apache Pinot 0.7.0 before 1.6.0.
- The gap applies when broker access control is enabled.
- lookup() identifies the dimension table outside the FROM clause.
Impact: Read unauthorized Pinot dimension tables via lookup()
| Product | Affected | Fixed in |
|---|---|---|
| Apache Pinot | 0.7.0 before 1.6.0 | 1.6.0 |
- 1.Upgrade Apache Pinot to 1.6.0.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73322 | Incorrect authorization in Apache Pinot single-stage lookup() | — | — |
From the original article
Posted by Yash Mayya on Oct 30 Severity: moderate Affected versions: - Apache Pinot 0. 7. 0 before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.