Apache Pinot vulnerability: Sensitive Information Disclosure Due to Inadequate Access Control

CVE-2024-39676

Summary

Apache Pinot contains a vulnerability that exposes sensitive information to unauthorized users. Specifically, when a request is made to the '/appconfigs' path on the controller, critical system and environment data is revealed, including architecture details, operating system version, maximum heap size, and crucial Pinot configurations like the Zookeeper path. To mitigate this vulnerability, users are strongly encouraged to upgrade to version 1.0.0 and implement Role-based Access Control (RBAC) to restrict access to the '/appconfigs' endpoint and other associated APIs. Properly configuring RBAC ensures that only authorized personnel can view sensitive data, thereby enhancing the security of the Apache Pinot deployment.

References