Apache Pinot before 1.6.0 can read unauthorized tables (CVE-2026-73322)
With broker access control on, lookup() can name a dimension table that the FROM-clause check never authorizes.
Stories per day · 30 days
1 stories, newest first · one card per story