← Vulnerability feed

Vulnerability record · CVE-2022-23974 · published 5 April 2022

CVE-2022-23974: Apache pinot vulnerability

Apache · Pinot

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0

7.5 CVSS 3.1 High EPSS 2.1% · top 19.3% CWE-674 · CWE-674
7.5CVSS 3.1 base score, v2 5.0
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr Mailing ListRelease NotesVendor Advisory
https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr Mailing ListRelease NotesVendor Advisory

Track CVE-2022-23974 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-56325Apache Pinot authentication bypass via alternate pathApache Pinot fails to require authentication when a request path does not contain a slash and contains a dot, allowing crafted requests to reach prot…EPSS 80%analysed9.8CVE-2022-26112Apache pinot code injection vulnerabilityIn 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to…EPSS 1.6%7.5CVE-2024-39676Apache pinot information exposure vulnerabilityExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Use…EPSS 0.85%

Source: NIST National Vulnerability Database (record CVE-2022-23974), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.