Apache Pinot - Exposure Detection

Detects if path Appconfigs of Apache Pinot web application is exposed, getting internal information about the configuration made. !/usr/bin/env python3 -- coding: utf-8 -- """Detects if path Appconfigs of Apache Pinot web application is exposed, getting internal information about the .""" from...

Apache Pinot - Detect

Detects a Apache Pinot web application, A realtime distributed OLAP datastore. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Pinot web application, A realtime distributed OLAP datastore.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apache Pinot < 1.3.0 - Authentication Bypass Detection

This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special...

EUVD-2026-37951

mcp-pinot: Unauthenticated tool invocation via default oauthenabled=False + host 0.0.0.0 bind...

CVE-2026-49257

mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and...

CVE-2026-49257: Missing Authentication for Critical Function

mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and...

CVE-2022-26112

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See...

EUVD-2022-6919

Malicious code in bioql PyPI...

EUVD-2025-9317

Malicious code in bioql PyPI...

EUVD-2022-1594

Malicious code in bioql PyPI...

CVE-2024-39676

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details: When using a request to path “/appconfigs” to the...

CVE-2022-23974

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release...

Apache Pinot Path Traversal Disclosure

The vulnerability of the Apache Pinot OLAP data store is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to expose protected information by sending a specially crafted GET request...

Authentication Bypass

Apache Pinot is vulnerable to Authentication Bypass. The vulnerability is due to improper request path validation due to the application's failure to enforce authentication when the request path contains a semicolon ; and lacks a forward slash /, allowing unauthorized user creation...

Apache Pinot Vulnerable to Authentication Bypass

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

GHSA-6JWP-4WVJ-6597 Apache Pinot Vulnerable to Authentication Bypass

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +4 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-broker (>=0.8.0, <=0.10.0)

org.apache.pinot:pinot-broker MAVEN version =0.8.0, =0.8.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: OSV:GHSA-6JWP-4WVJ-6597...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +4 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-broker (>=0.8.0, <=0.10.0)

org.apache.pinot:pinot-broker MAVEN version =0.8.0, =0.8.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: GHSA-6JWP-4WVJ-6597...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +7 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-controller (>=0.8.0, <=1.2.0)

org.apache.pinot:pinot-controller MAVEN version =0.8.0, =0.8.0, =0.11.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: OSV:GHSA-6JWP-4WVJ-6597...

CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...