PT-2026-133747
CVE-2026-73322
·
Published
2026-10-30
·
Updated
2026-10-31
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache Pinot versions prior to 1.6.0
Description
An incorrect authorization issue exists in the single-stage query engine. When broker access control is enabled, the engine only authorizes the table specified in the FROM clause. Because the
lookup() transform function identifies its dimension table using a string literal argument instead of the FROM clause, that table bypasses authorization checks. Consequently, an authenticated user with access to at least one table can read columns and retrieve arbitrary rows from any dimension table in the cluster, regardless of their permissions. Additionally, per-principal row-level security filters on the dimension table are not applied.Recommendations
Upgrade to version 1.6.0.
Found an issue in the description? Have something to add? Feel free to write us 👾