{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pinot-0.7.0--v--1.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-73322"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pinot (0.7.0 \u003c= v \u003c 1.6.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache Software Foundation"],"content_html":"\u003cp\u003eApache Pinot versions 0.7.0 through 1.5.0 contain an authorization vulnerability in the single-stage query engine. When broker access control is enabled, the query engine validates access only for tables explicitly defined in the FROM clause. The lookup() transform function, which retrieves data from dimension tables via a string literal argument, fails to undergo the same authorization checks, allowing authenticated users to access dimension tables for which they lack permissions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform unauthorized read operations on sensitive dimension tables that are not explicitly protected by the FROM clause authorization logic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade Apache Pinot instances to version 1.6.0 or later to ensure the lookup() function correctly honors broker access control policies. If an immediate upgrade is not possible, review query logs for unauthorized attempts to access dimension tables via the lookup() function.\u003c/p\u003e\n","date_modified":"2026-10-30T17:22:17Z","date_published":"2026-10-30T17:22:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-pinot-cve-2026-73322/","summary":"An authorization vulnerability in the Apache Pinot single-stage query engine allows users to read unauthorized dimension tables by utilizing the lookup() transform function, which bypasses table-level access controls.","title":"Apache Pinot: Incorrect authorization in single-stage query engine (CVE-2026-73322)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-pinot-cve-2026-73322/"}],"language":"en","title":"CraftedSignal Threat Feed - Pinot (0.7.0 \u003c= v \u003c 1.6.0)","version":"https://jsonfeed.org/version/1.1"}