CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()

As cited

Copy frozen at 2026-10-30 20:09 UTC (site build).

vulnerabilities

CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()

CVE-2026-73322 is an incorrect authorization vulnerability in Apache Pinot's single-stage query engine that allows attackers to read unauthorized dimension tables through the lookup() function. When broker access control is enabled, the engine fails to authorize tables specified as string literal arguments in the lookup() function, only checking the table in the FROM clause. The vulnerability affects Apache Pinot versions 0.7.0 through 1.5.x with moderate severity.

Why it matters: Organizations running Apache Pinot 0.7.0 to 1.5.x with broker access control enabled should upgrade to 1.6.0 or later, as attackers can bypass authorization controls to access restricted dimension tables.

Source published

2026-10-30 16:20 UTC

First seen by Cybersecurity Tracker

2026-10-30 19:01 UTC