Apache Pinot Authentication Bypass Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- org.apache.pinot:pinot-broker (maven)
- Affected versions
- >= 0.8.0, < 1.3.0 or >= 0.10.0, <= 0.10.0 or >= 0.11.0, <= 0.11.0 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.3, <= 0.9.3 or >= 1.0.0, <= 1.0.0 or >= 1.1.0, <= 1.1.0 or >= 1.2.0, <= 1.2.0
- Patched version
- Not yet available
Apache Pinot is reportedly vulnerable to an authentication bypass issue that allows unauthorized user addition. Affected components include pinot-broker, pinot-common, and pinot-controller.
What happened
Apache Pinot is under investigation for a critical vulnerability that allows an authentication bypass. This issue enables an attacker to add a new user without proper authentication, potentially gaining control over the Pinot system. The affected components are pinot-broker, pinot-common, and pinot-controller. Versions affected include a wide range from 0.8.0 to 1.2.0 for pinot-broker and pinot-common, and a similarly broad range for pinot-controller.
The vulnerability was first flagged on April 1, 2025. It is classified as a critical CVE and has a high severity rating. The issue has not been exploited in the wild as of the latest reports. The recommended action is to upgrade to the latest version of the affected components and ensure that all paths include '/' and 'contain.' to require authentication.
What to do about it
- Upgrade to the latest version of Apache Pinot components.
- Ensure that all paths include '/' and 'contain.' to require authentication.
- Monitor the primary sources for updates on patched versions.
How 0Day would have caught this
org.apache.pinot:pinot-broker is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Apache Pinot components pinot-broker, pinot-common, or pinot-controller in versions >= 0.8.0, < 1.3.0.
What should I do right now?
Upgrade to the latest version of the affected components and ensure that all paths include '/' and 'contain.' to require authentication.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild as of the latest reports.