Pinot’s upstream CI uses Dependabot for dependency updates and Trivy to scan the built Docker image for OS and library vulnerabilities at `HIGH`/`CRITICAL` severity. For production, I’d also scan the exact image digest and plugin set you plan to deploy, since results can vary with packaging and the base image. See the 1.5.1 Trivy workflow and Dependabot configuration. For 1.5.1 specifically, it was released as a security-only update to 1.5.0. The release verification reported 0 critical and 0 high findings in the binary distribution. It upgraded or excluded affected Netty, Log4j, Jetty, BouncyCastle, HttpClient, and other dependencies. The details and addressed CVEs are in the 1.5.1 release notes. The ASF Pinot advisory page currently lists only older Pinot vulnerabilities whose affected ranges end before 1.5.1. So there is no currently published critical vulnerability identified as affecting 1.5.1. That is still a point-in-time statement, so continuing to scan the deployed artifact is recommended. For production, also follow the Pinot security-hardening guide—particularly authentication, TLS, network isolation, and restricting Controller/admin endpoints. Newly discovered, undisclosed vulnerabilities should be reported privately through the ASF security process at

<mailto:security@apache.org|security@apache.org>

, rather than posted publicly.