← Vulnerability feed

Vulnerability record · CVE-2022-26112 · published 23 September 2022

CVE-2022-26112: Apache pinot code injection vulnerability

Apache · Pinot

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0

9.8 CVSS 3.1 Critical EPSS 1.6% · top 25.1% CWE-94 · Code injection
9.8CVSS 3.1 base score
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h Mailing ListPatchThird Party Advisory
https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h Mailing ListPatchThird Party Advisory

Track CVE-2022-26112 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-56325Apache Pinot authentication bypass via alternate pathApache Pinot fails to require authentication when a request path does not contain a slash and contains a dot, allowing crafted requests to reach prot…EPSS 80%analysed7.5CVE-2024-39676Apache pinot information exposure vulnerabilityExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Use…EPSS 0.85%7.5CVE-2022-23974Apache pinot vulnerabilityIn 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations t…EPSS 2.1%

Source: NIST National Vulnerability Database (record CVE-2022-26112), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.