SZB-e7c8a3564e
Apache Pinot discloses CVE-2026-73322, an authorization flaw in lookup() queries
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Apache Pinot
- Product
- Apache Pinot single-stage query engine
- First seen
Summary
Posted to oss-security by Yash Mayya, the advisory describes an incorrect authorization flaw in Apache Pinot 0.7.0 before 1.6.0. With broker access control enabled, the single-stage engine checks only the FROM-clause table, so lookup() can read unauthorized dimension tables.
If you use Apache Pinot
Upgrade Apache Pinot to 1.6.0 or later
Review which users can run lookup() queries against dimension tables
Audit broker query logs for lookup() calls on restricted tables
What the sources say 1
· oss-security: “Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot.” Source