MediumVulnerabilityCVE-2026-73322updated 30 Oct 2026, 19:22 UTC

Apache Pinot: lookup() bypasses authorization, exposing dimension tables

Official, 2 sources

Severity	MediumVulnerability
Being exploited?	UnclearNo reports either way yet
Fix available?	UnclearNo fixed version published in the sources yet
How sure is this?	Official, 2 sourcesBacked by an official source

Timeline

30 Oct 2026, 16:20 UTC
Publicly disclosed
30 Oct 2026, 16:20 UTC
Reported by oss-security · oss-security
30 Oct 2026, 16:30 UTC
Picked up by Zero Radar
30 Oct 2026, 19:22 UTC
NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-73322NVD · 30 Oct 2026, 19:19 UTC

Security researchers research teams and mailing lists

CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookoss-security · 30 Oct 2026, 16:20 UTC

Technical details

ID: CVE-2026-73322
Disclosed: 30 Oct 2026, 16:20 UTC
On Zero Radar: 30 Oct 2026, 16:30 UTC (11 min after disclosure)
Last change: 30 Oct 2026, 19:22 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Apache Pinot: lookup() bypasses authorization, exposing dimension tables · Zero Radar