Cyber ·
CVE-2026-73322: Apache Pinot allows querying unauthorized dimension tables
Moderate-severity advisory: with broker access control enabled, the Apache Pinot lookup() function can read unauthorized dimension tables. Affects versions 0.7.0 up to before 1.6.0.
Advisory CVE-2026-73322, published on the oss-sec list on October 30, 2026, describes an incorrect authorization flaw in Apache Pinot, rated moderate. According to the text, versions from 0.7.0 up to those before 1.6.0 are affected. The single-stage query engine authorizes only the table named in the FROM clause. However, the lookup() transformation function identifies its dimension table through a string literal argument rather than the FROM clause. As a result, when broker access control is enabled, the function may allow reading unauthorized dimension tables. The available excerpt does not detail the fix or mitigation measures. To confirm these points, consult the original advisory and the project release notes, and compare your installed Pinot version with the affected range.