CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
CVE-2026-73322 key facts
- CISA KEV
- Not listed (catalogue checked )
- Highest advisory rating
- Medium
- CVSS base score
- 6.5 (Red Hat)
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N· base score 6.5, scored by CISA-ADPAttack vector: network. Attack complexity: low. Privileges required: low. User interaction: none. Scope: unchanged. Confidentiality impact: high. Integrity impact: none. Availability impact: none.- Weakness
- CWE-863 Incorrect Authorization
- EPSS
- 0.29% chance of exploitation in the next 30 days (21st percentile). FIRST EPSS, .
- CISA SSVC
- Exploitation: none observed. Automatable: no. Technical impact: partial. CISA, .
- Fixed releases
- Apache: 1.6.0
- Red Hat: 1.5.1, 1.6.0
- Assigned by
- apache (CNA)
- CVE record published
- Listed by VulniPulse
- Record changed
Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-73322; each belongs to its advisory, not to every product listed. How records are collected and checked.
Description
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so that table was never included in the authorization check. An authenticated user who is authorized for at least one table can therefore read columns from any dimension table in the cluster, including tables they have no access to, and can retrieve arbitrary rows of it by supplying primary key values directly. Per-principal row-level security filters configured on the dimension table are likewise not applied. The multi-stage query engine is not affected. This issue affects Apache Pinot: through 1.5.1 Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Text from the CVE.org record (apache).
How do I fix CVE-2026-73322?
Upgrade to a fixed release named by the vendor:
- Apache: 1.6.0
- Red Hat: 1.5.1, 1.6.0
- This issue affects Apache Pinot: through 1.5.1 Users are recommended to upgrade to version 1.6.0, which fixes this issue. (Apache)
Vendor advisories for CVE-2026-73322
Apache
1 advisory- Advisory severityUnrated
Advisory [CVE-2026-73322] Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot
CVE-2026-73322Source published Source updated
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so that table was never included in the authorization check. An authenticated user who is authorized for at least one table can therefore read columns from any dimension table in the cluster, including tables they have no access to, and can retrieve arbitrary rows of it by supplying primary key values directly. Per-principal row-level security filters configured on the dimension table are likewise not applied. The multi-stage query engine is not…
- Affected products in this advisory
- Apache Pinot
- Source-reported affected versions
- through 1.5.1
- Source-reported fixed versions
- 1.6.0
- Mitigation guidance
- This issue affects Apache Pinot: through 1.5.1 Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-73322] Information disclosure via lookup transform function
CVE-2026-73322Source published Source updated
Information disclosure via lookup transform function. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-639.
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- 1.5.1
- 1.6.0
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
References
Timeline
- CVE record published
- First vendor advisory listed by VulniPulse
- CVE record last updated
More Apache advisories
CVE-2026-89326Nov 11, 2026Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resourceCVE-2026-106023Nov 11, 2026NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP requestCVE-2026-109163Nov 11, 2026Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_aliasCVE-2026-119618Nov 11, 2026Concurrent Execution using Shared Resource with Improper SynchronizationCVE-2026-71395Nov 11, 2026unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOPCVE-2026-44929Nov 11, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
