Apache Pinot vulnerabilities

4 CVEs affecting Apache Pinot, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-56325, published 2025-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-56325, published 2025-04-01. Critical severity, CVSS 9.8. EPSS: 80.2% chance of exploitation in the next 30 days. Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type:…
CVE-2022-23974, published 2022-04-05. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a…
CVE-2022-26112, published 2022-09-23. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid…
CVE-2024-39676, published 2024-07-24. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version…