Apache Pinot < 1.3.0 - Authentication Bypass

This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special...

GHSA-FJ9W-C36G-H5X8 vulnerabilities

Vulnerabilities for packages: pinot-fips, druid, pinot...

CVE-2026-85716 vulnerabilities

Vulnerabilities for packages: pinot-fips, druid, pinot...

CVE-2026-55688 vulnerabilities

Vulnerabilities for packages: tez, apache-pulsar, pinot, pinot-fips, apache-pulsar-fips, druid...

GHSA-M452-Q8C9-RG2F vulnerabilities

Vulnerabilities for packages: tez, apache-pulsar, pinot, pinot-fips, apache-pulsar-fips, druid...

CVE-2026-56818 vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, pinot...

GHSA-P9JM-Q85P-7MCP vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, pinot...

GHSA-WC96-39FC-566F vulnerabilities

Vulnerabilities for packages: tez, pinot, seata, thingsboard, pinot-fips, apache-hop, hadoop-fips, apache-hop-fips, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop, cassandra-fips...

GHSA-G7HG-VRCF-MVMR vulnerabilities

Vulnerabilities for packages: tez, pinot, seata, thingsboard, pinot-fips, apache-hop, hadoop-fips, apache-hop-fips, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop, cassandra-fips...

CVE-2026-56822 vulnerabilities

Vulnerabilities for packages: tez, pinot, seata, thingsboard, pinot-fips, apache-hop, hadoop-fips, apache-hop-fips, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop, cassandra-fips...

CVE-2026-56820 vulnerabilities

Vulnerabilities for packages: tez, pinot, seata, thingsboard, pinot-fips, apache-hop, hadoop-fips, apache-hop-fips, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop, cassandra-fips...

CVE-2026-56821 vulnerabilities

Vulnerabilities for packages: tez, pinot, seata, thingsboard, pinot-fips, apache-hop, hadoop-fips, apache-hop-fips, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop, cassandra-fips...

GHSA-272M-GCWP-MPWG vulnerabilities

Vulnerabilities for packages: tez, pinot, seata, thingsboard, pinot-fips, apache-hop, hadoop-fips, apache-hop-fips, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop, cassandra-fips...

CVE-2026-56741 vulnerabilities

Vulnerabilities for packages: scala, tez, apache-pulsar-fips, zookeeper-fips, apache-hop, ranger, apache-hop-fips, kafka-fips, hadoop-client-modules, zookeeper, kafka, apache-nifi, spark-kubernetes-operator, spark-kubernetes-operator-fips, spark, confluent-kafka-jre-bcfips, confluent-kafka,...

CVE-2026-56740 vulnerabilities

Vulnerabilities for packages: scala, tez, apache-pulsar-fips, zookeeper-fips, apache-hop, ranger, apache-hop-fips, kafka-fips, hadoop-client-modules, zookeeper, kafka, apache-nifi, spark-kubernetes-operator, spark-kubernetes-operator-fips, spark, confluent-kafka-jre-bcfips, confluent-kafka,...

GHSA-VHCH-2WF3-M8RP vulnerabilities

Vulnerabilities for packages: trino, tez, pinot, celeborn, seata, thingsboard, pinot-fips, management-api-for-apache-cassandra-4.0, apache-hop, management-api-for-apache-cassandra-4.1, hadoop-fips, apache-hop-fips, management-api-for-apache-cassandra-5.0, tinkerpop...

CVE-2026-44891 vulnerabilities

Vulnerabilities for packages: trino, tez, pinot, celeborn, seata, thingsboard, pinot-fips, management-api-for-apache-cassandra-4.0, apache-hop, management-api-for-apache-cassandra-4.1, hadoop-fips, apache-hop-fips, management-api-for-apache-cassandra-5.0, tinkerpop...

PYSEC-2026-410 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Resolution Fixed in v3.1.0, released 2026-05-25. The fix was merged in PR 95 at commit 1c7d3f9. The fix changes the default HTTP bind host to 127.0.0.1, refuses non-loopback HTTP/HTTPS exposure unless OAuth is enabled, makes Helm exposure opt-in and OAuth-gated, and adds parser-backed...

PYSEC-2026-267 OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...