// What runs on ZooKeeper / pinot
Does Apache Pinot use ZooKeeper?
Required (through Helix)Yes. Pinot uses Apache Helix for cluster management, and Helix uses ZooKeeper as its state store. Pinot's documentation calls ZooKeeper a first-class citizen of a Pinot cluster, and the smallest possible Pinot cluster it describes is a controller, a broker, a server and a ZooKeeper node. There is no ZooKeeper-free mode.
Trusted globally by enterprises
What Apache Pinot uses ZooKeeper for
- Controller leadership: which controller is the current Helix leader.
- Cluster membership: the servers and brokers in the cluster and their configuration.
- Table configurations, schemas and each table's list of segments.
- Segment state: which servers hold each segment, whether it is online, offline, consuming or in error, and per-segment metadata.
- Change notifications: ZooKeeper tells Helix spectators when cluster state changes.
Which ZooKeeper version ships with Apache Pinot
From the zookeeper.version and helix.version properties in pom.xml at each release tag. The ZooKeeper client ships inside the Pinot distribution, so scanners flag it whatever version the ensemble runs. pinot-admin.sh StartZookeeper starts a local ZooKeeper server from that same bundled code for quick starts, and the Pinot Helm chart installs the Bitnami ZooKeeper chart (13.x) by default.
| Release | ZooKeeper | ZooKeeper line status | Open ZooKeeper CVEs |
|---|---|---|---|
| Pinot 0.10.0 and 0.11.0Helix 0.9.8 and 1.0.4 | 3.5.8 | End of life since 1 June 2022Bundles log4j 1.2.17 | 1 (CVE-2023-44981)2026 advisories not assessed for this line |
| Pinot 0.12.1 and 1.0.0Helix 1.0.4 | 3.6.3 | End of life since 30 December 2022Bundles log4j 1.2.17 | 2 (CVE-2023-44981, CVE-2024-23944)2026 advisories not assessed for this line |
| Pinot 1.1.0Helix 1.3.1 | 3.7.2 | End of life since 2 February 2024 | 1 (CVE-2024-23944)2026 advisories not assessed for this line |
| Pinot 1.2.0Helix 1.3.1 | 3.9.2 | Supported (latest 3.9.6) | 7 (CVE-2024-51504, CVE-2025-58457, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Pinot 1.3.0 and 1.4.0Helix 1.3.1 and 1.3.2 | 3.9.3 | Supported (latest 3.9.6) | 6 (CVE-2025-58457, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Pinot 1.5.0 and 1.5.1Helix 1.3.2 | 3.9.5 | Supported (latest 3.9.6) | 3 (CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
CVE counts are ZooKeeper's own advisories matched against the upstream version. The Apache ZooKeeper project does not assess end-of-life lines against new advisories, so "not assessed" means unknown, not safe.
What ZooKeeper 3.5.8 is exposed to
CVE-2023-44981 · CVSS 9.1 · fixed in 3.7.2, 3.8.3, 3.9.1
SASL quorum peer authentication bypass, giving full read-write access to the data tree. Applies when quorum.auth.enableSasl=true.
Find the ZooKeeper Pinot is using
# Ensemble address and Helix cluster name grep -E 'controller.zk.str|controller.helix.cluster.name' conf/pinot-controller.conf # What Pinot keeps there, through the controller API curl -s 'http://controller:9000/zk/ls?path=/PinotCluster' # Version of the ensemble echo srvr | nc zk1.internal 2181 | head -1
Can Apache Pinot run without ZooKeeper?
No. Helix keeps all of Pinot's cluster state in ZooKeeper, and every controller, broker, server and minion is started with a ZooKeeper address. Pinot's documentation warns that the znode layout can change between releases, so tooling that reads it directly should be checked on each upgrade.
Pinot 1.5.1, released on 5 June 2026, is the latest release. Since 1.0.0 (September 2023), Pinot has shipped a new minor release every four to seven months. 1.5.1 is the only patch release in that series, so fixes generally arrive in the next minor release.
Your options
Upgrade Pinot
Pinot 1.2.0 and later build against ZooKeeper 3.9. Even 1.5.1 builds against 3.9.5, which predates the fixes released in 3.9.6 in September 2026.
Keep the ensemble current
The ensemble under Helix is upgraded separately from Pinot. Rolling it to 3.9.6 brings the servers up to the September 2026 fixes. The client inside Pinot is a separate jar with its own version.
Patch Pinot and its ZooKeeper
OSSeva ships patched Pinot 1.x builds, including the bundled ZooKeeper client, patches the ensemble under Helix, and provides VEX statements for scanner findings.
Most teams buy this at the product level: keep the Apache Pinot estate supported, including the ZooKeeper under it. See Apache Pinot support.
Frequently asked questions
Does Pinot need ZooKeeper?
Yes, through Apache Helix, which stores Pinot's cluster state in ZooKeeper. There is no ZooKeeper-free mode.
Which ZooKeeper version does Pinot 1.5 use?
Pinot 1.5.0 and 1.5.1 build against ZooKeeper 3.9.5, with Helix 1.3.2. The five ZooKeeper advisories published on 16 September 2026 affect 3.9.0 to 3.9.5 and are fixed in 3.9.6.
Which ZooKeeper does Pinot 1.0 use?
Pinot 1.0.0 builds against ZooKeeper 3.6.3. The 3.6 line reached end of life on 30 December 2022, and 3.6.3 is within the affected ranges of CVE-2023-44981 and CVE-2024-23944.
Can I inspect Pinot's ZooKeeper data without zkCli?
Yes. The controller UI includes a ZooKeeper browser, and the controller REST API exposes /zk/ls, /zk/get and related endpoints. Pinot's documentation notes that the znode structure can change in future releases.
Keep Apache Pinot and the ZooKeeper under it supported.
Send us your versions; we reply with coverage, exposure and a plan within five working days.