9.8
Critical
CVE-2022-26112 In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in…
Description
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Pinot 0.10 | earliest → 0.10.0 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Pinot
The 5 CVEs of Apache Pinot →
CVE-2026-73322
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot
Not rated
CVE-2024-56325
Authentication Bypass Issue
If the path does not contain / and contain., authentication is not required
Not rated
CVE-2024-39676
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot
Not rated
CVE-2022-23974
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot…
Not rated