Cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aapachepinot/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:22:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Pinot: Incorrect authorization in single-stage query engine (CVE-2026-73322)https://feed.craftedsignal.io/briefs/2026-10-apache-pinot-cve-2026-73322/Fri, 30 Oct 2026 17:22:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-pinot-cve-2026-73322/An authorization vulnerability in the Apache Pinot single-stage query engine allows users to read unauthorized dimension tables by utilizing the lookup() transform function, which bypasses table-level access controls.Apache Pinot versions 0.7.0 through 1.5.0 contain an authorization vulnerability in the single-stage query engine. When broker access control is enabled, the query engine validates access only for tables explicitly defined in the FROM clause. The lookup() transform function, which retrieves data from dimension tables via a string literal argument, fails to undergo the same authorization checks, allowing authenticated users to access dimension tables for which they lack permissions.

Impact

Successful exploitation allows an authenticated user to perform unauthorized read operations on sensitive dimension tables that are not explicitly protected by the FROM clause authorization logic.

Recommendation

Upgrade Apache Pinot instances to version 1.6.0 or later to ensure the lookup() function correctly honors broker access control policies. If an immediate upgrade is not possible, review query logs for unauthorized attempts to access dimension tables via the lookup() function.

]]>mediumadvisory