CVE-2026-73322
Description
A flaw was found in Apache Pinot. When broker access control is enabled, the single-stage query engine validates permissions only for tables declared in the query's FROM clause. Because the lookup() transform function references dimension tables through string arguments, those tables bypass authorization checks and row-level security filters. An authenticated attacker with access to at least one table can exploit this flaw to read unauthorized data from any dimension table across the cluster, leading to information disclosure.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires a valid authenticated user account with access to at least one table, limiting the scope of unauthorized access strictly to read-only information disclosure. The issue specifically resides in Apache Pinot's single-stage query engine when broker access control is enabled. Apache Pinot is not included or supported across Red Hat enterprise software offerings, meaning there is no direct risk to Red Hat environments.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
