{"id":"CVE-2022-26112","aliases":["EUVD-2022-6919","GHSA-qj9p-jvmw-82rh"],"status":"published","title":"Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support","description":"In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01644,"percentile":0.76598,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2022-09-23T08:05:13Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Maven","package":"org.apache.pinot:pinot","fixed_in":["0.11.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pinot:pinot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pinot:pinot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0"}]}],"versions":["0.1.0","0.10.0","0.2.0","0.3.0","0.4.0","0.5.0","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3"]}],"products":[{"vendor":"apache","product":"pinot"},{"vendor":"apache software foundation","product":"apache pinot"}],"references":[{"url":"https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26112","tags":["advisory"]},{"url":"https://github.com/apache/pinot/pull/8711","tags":["web"]},{"url":"https://docs.pinot.apache.org/basics/releases/0.11.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qj9p-jvmw-82rh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26112.json","tags":["advisory"]},{"url":"https://github.com/apache/pinot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-26112","title":"Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support","description":"In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0","status":"published","published":"2022-09-23T08:05:13Z","modified":"2025-05-27T14:46:56.726Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-6919","description":"In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0","status":"published","published":"2022-09-23T08:05:13Z","modified":"2025-05-27T14:46:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:38.348652Z"}],"ghsa":[{"id":"GHSA-qj9p-jvmw-82rh","title":"Apache Pinot has Groovy Function support enabled by default","description":"Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.","status":"published","published":"2022-09-25T00:00:26Z","modified":"2025-05-28T19:33:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:44.991725Z"}],"nvd":[{"id":"CVE-2022-26112","description":"In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0","status":"published","published":"2022-09-23T08:15:08.78Z","modified":"2026-06-17T04:34:42.377Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"CVE-2022-26112","title":"Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support","description":"In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0","status":"published","published":"2022-09-23T08:05:13Z","modified":"2026-10-28T02:30:56.168565968Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-qj9p-jvmw-82rh","title":"Apache Pinot has Groovy Function support enabled by default","description":"Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.","status":"published","published":"2022-09-25T00:00:26Z","modified":"2025-05-28T19:59:10.492051Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}