Apache Pinot has Groovy Function support enabled by default

CRITICAL 9.8CVE-2022-26112 · GHSA-qj9p-jvmw-82rh · Published 23/09/2022 · updated 17/06/2026

In short

CVE-2022-26112 is a CRITICAL (CVSS 9.8) vulnerability affecting org.apache.pinot:pinot, pinot (apache).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.4% of all vulnerabilities.
Fix: update to 0.11.0 or later.

Package	Affected versions	Patched versions
org.apache.pinot:pinot Maven	`< 0.11.0`	`0.11.0`
pinot apache	`< 0.11.0`	`0.11.0`

Description

Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.

NVD description

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0

References

nvd.nist.gov/vuln/detail/CVE-2022-26112 · ADVISORY
apache/pinot#8711 · WEB
docs.pinot.apache.org/basics/releases/0.11.0 · WEB
apache/pinot · PACKAGE
lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h · WEB

More vulnerabilities in org.apache.pinot:pinot

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.pinot:pinot

Maven

< 0.11.0

0.11.0

pinot

apache

< 0.11.0

0.11.0

Description

NVD description