Read the docs
TI-2024-26600 Aliases CVE-2024-39676GHSA-8gj9-r4hv-3jjw

Apache Pinot: Unauthorized endpoint exposed sensitive information

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details:  When using a request to path “/appconfigs” to the controller, it can lead to the disclosure of sensitive information such as system information (e.g. arch, os version), environment information (e.g. maxHeapSize) and Pinot configurations (e.g. zookeeper path). This issue was addressed by the Role-based Access Control https://docs.pinot.apache.org/operators/tutorials/authentication/basic-auth-access-control , so that /appConfigs` and all other APIs can be access controlled. Only authorized users have access to it. Note the user needs to add the admin role accordingly to the RBAC guide to control access to this endpoint, and in the future version of Pinot, a default admin role is planned to be added.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00846 58th percentileScored 2026-11-07
Fix Fixed Apache Pinot (Apache Software Foundation): 1.0.0org.apache.pinot:pinot-controller (Maven): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Pinot0.1 to before 1.0.01.0.0Patch availableCNA
—org.apache.pinot:pinot-controller (Maven)0.1 to before 1.0.01.0.0Patch availableGHSA-8gj9-r4hv-3jjw
  • Apache Pinot VendorApache Affected 0.1 to before 1.0.0 Fixed in 1.0.0 Patch available CNA
  • org.apache.pinot:pinot-controller (Maven) Vendor— Affected 0.1 to before 1.0.0 Fixed in 1.0.0 Patch available GHSA-8gj9-r4hv-3jjw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:*0.1.0 to before 1.0.0VulnerableApache
  • cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:* Versions 0.1.0 to before 1.0.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Pinot (Apache Software Foundation) Fixed in 1.0.0
  • Fix · GHSA-8gj9-r4hv-3jjw org.apache.pinot:pinot-controller (Maven) Fixed in 1.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-39676
  2. 2026-10-03 Alias added: GHSA-8gj9-r4hv-3jjw

References

Advisory 2

Other 3

  • TI-2024-37286 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required CVSS 3.1CRITICAL 9.8
  • TI-2022-09576 Code injection in Apache Pinot CVSS 3.1CRITICAL 9.8
  • TI-2022-07939 Pinot segment push endpoint has a vulnerability in unprotected environments CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences