CVE-2024-56325: Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Exp

Q: How do I fix CVE-2024-56325?

pinot: upgrade to 1.3.0. Exact commands for each OS are on this page.

Q: Is CVE-2024-56325 being exploited?

CVE-2024-56325 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2024-56325 affect?

CVE-2024-56325 affects pinot. Severity is critical (CVSS 9.8). Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\

Q: How urgent is CVE-2024-56325?

Priority 72/100. Critical severity; EPSS top 1%: very likely to be exploited; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

This week

CRITICAL 9.8REMOTEWATCHLISTUPGRADE

CVE-2024-56325 is a critical-severity flaw (CVSS 9.8) affecting pinot. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	80.2% (top 1%)
CISA exploited list	No
Weakness	CWE-288
Published	2025-04-01
Last modified	2026-06-17

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-04-01 09:15 UTCPublished CVE record published
2026-06-17 08:12 UTCUpdated Record last modified

apache pinot UPGRADE

Affected: < 1.3.0

Fixed in: 1.3.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy pinot || rpm -q pinot || pinot --version

2. UPGRADE to 1.3.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade pinot

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade pinot

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Maven · org.apache.pinot:pinot-broker · FIXED · 1.3.0 · vulnerable: >= 0.8.0, < 1.3.0 · source

Set org.apache.pinot:pinot-broker to 1.3.0 or later in pom.xml or build.gradle, then rebuild and redeploy.

Maven · org.apache.pinot:pinot-common · FIXED · 1.3.0 · vulnerable: >= 0.8.0, < 1.3.0 · source

Set org.apache.pinot:pinot-common to 1.3.0 or later in pom.xml or build.gradle, then rebuild and redeploy.

Maven · org.apache.pinot:pinot-controller · FIXED · 1.3.0 · vulnerable: >= 0.8.0, < 1.3.0 · source

Set org.apache.pinot:pinot-controller to 1.3.0 or later in pom.xml or build.gradle, then rebuild and redeploy.

Fedora ELN · ibus-typing-booster · FIXED · 2.31.3-1.eln159 · FEDORA-2026-c895c68d60 · source

sudo dnf upgrade --advisory=FEDORA-2026-c895c68d60

Fedora 46 · perl-WWW-OrangeHRM-Client · FIXED · 0.12.0-21.fc46 · FEDORA-2026-2d14efca09 · source

sudo dnf upgrade --advisory=FEDORA-2026-2d14efca09

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Nuclei scan template: Apache Pinot < 1.3.0 - Authentication Bypass

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-56325?

pinot: upgrade to 1.3.0. Exact commands for each OS are on this page.

Is CVE-2024-56325 being exploited?

CVE-2024-56325 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-56325 affect?

CVE-2024-56325 affects pinot. Severity is critical (CVSS 9.8). Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\

How urgent is CVE-2024-56325?

Priority 72/100. Critical severity; EPSS top 1%: very likely to be exploited; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

Software pages

curl vulnerabilities

Related CVEs

CVE-2024-39676 HIGH 7.5 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects

References

← Back to latest CVEs