MAVEN · APRIL 2025 · EARLY WARNING

Apache Pinot Authentication Bypass Vulnerability: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
org.apache.pinot:pinot-broker (maven)
Affected versions
>= 0.8.0, < 1.3.0 or >= 0.10.0, <= 0.10.0 or >= 0.11.0, <= 0.11.0 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.3, <= 0.9.3 or >= 1.0.0, <= 1.0.0 or >= 1.1.0, <= 1.1.0 or >= 1.2.0, <= 1.2.0
Patched version
Not yet available
GHSA-6JWP-4WVJ-6597

Apache Pinot is reportedly vulnerable to an authentication bypass issue that allows unauthorized user addition. Affected components include pinot-broker, pinot-common, and pinot-controller.

What happened

Apache Pinot is under investigation for a critical vulnerability that allows an authentication bypass. This issue enables an attacker to add a new user without proper authentication, potentially gaining control over the Pinot system. The affected components are pinot-broker, pinot-common, and pinot-controller. Versions affected include a wide range from 0.8.0 to 1.2.0 for pinot-broker and pinot-common, and a similarly broad range for pinot-controller.

The vulnerability was first flagged on April 1, 2025. It is classified as a critical CVE and has a high severity rating. The issue has not been exploited in the wild as of the latest reports. The recommended action is to upgrade to the latest version of the affected components and ensure that all paths include '/' and 'contain.' to require authentication.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If org.apache.pinot:pinot-broker is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using Apache Pinot components pinot-broker, pinot-common, or pinot-controller in versions >= 0.8.0, < 1.3.0.

What should I do right now?

Upgrade to the latest version of the affected components and ensure that all paths include '/' and 'contain.' to require authentication.

Has this been exploited in the wild?

No, this vulnerability has not been exploited in the wild as of the latest reports.

Sources

Join the 0Day waitlist →

← Back to all threats