Authorization Flaw in Apache Pinot Affecting Data Security

CVE-2026-73322

What is CVE-2026-73322?

An authorization vulnerability in the single-stage query engine of Apache Pinot can lead to unauthorized data access when broker access control is enabled. Specifically, it fails to adequately authorize the dimension table identified by the lookup() transform function, allowing authenticated users to access sensitive data from tables for which they do not have explicit permission. This flaw can result in users retrieving arbitrary rows by directly supplying primary key values. Notably, the multi-stage query engine remains unaffected. Users are advised to upgrade to version 1.6.0 to mitigate this risk.

References