CVEsApache Software FoundationCVE-2022-26112Published Sep 23, 2022, 08:05 · Updated May 27, 2025, 14:46 UTC
9.8
CriticalCVSS 3.1 · from CISA
CVE-2022-26112
Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
Apache Pinot · Code injection · CWE-94AffectedApache Pinot
FixNo fix listed yet.
PublishedSep 23, 2022, 08:05 · apache
Scored9.8 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0
From apache
Affected and fixed versions
ProductAffectedFixed inApache PinotApache Pinot – 0.10.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known