medium advisory October 30, 2026

Apache Pinot: Incorrect authorization in single-stage query engine (CVE-2026-73322)

An authorization vulnerability in the Apache Pinot single-stage query engine allows users to read unauthorized dimension tables by utilizing the lookup() transform function, which bypasses table-level access controls.

Triage facts

Revision 1

Applicability: Pinot (0.7.0 <= v < 1.6.0)
Evidence: Unknown
Severity: Medium
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Oct 30, 17:22 UTC
Vulnerabilities: 1 CVE
Source quality: D3Roughly even chance

Apache Pinot versions 0.7.0 through 1.5.0 contain an authorization vulnerability in the single-stage query engine. When broker access control is enabled, the query engine validates access only for tables explicitly defined in the FROM clause. The lookup() transform function, which retrieves data from dimension tables via a string literal argument, fails to undergo the same authorization checks, allowing authenticated users to access dimension tables for which they lack permissions.

Impact

Successful exploitation allows an authenticated user to perform unauthorized read operations on sensitive dimension tables that are not explicitly protected by the FROM clause authorization logic.

Recommendation

Upgrade Apache Pinot instances to version 1.6.0 or later to ensure the lookup() function correctly honors broker access control policies. If an immediate upgrade is not possible, review query logs for unauthorized attempts to access dimension tables via the lookup() function.

Immediate actions

Patch Apache Pinot to version 1.6.0 or later

IT Operations 48h

Threat Hunt

Identify abnormal usage of the lookup() transform function in query logs

T1005 medium medium confidence hunt now

Data: Apache Pinot broker logs, Query audit logs

Mitigations

Upgrade to Apache Pinot 1.6.0

immediate IT Operations

CVE-2026-73322