EUVD-2026-37951
GHSA-73cv-556c-w3g6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Default 0.0.0.0 bind with no auth means network-reachable, low-complexity, unauthenticated, no UI; tools mutate a separate Pinot cluster (scope change) with full read/write/admin impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and table-config mutation, are reachable by any network-adjacent caller. The server proxies these calls using server-side Pinot credentials, producing a confused-deputy condition that yields full read/write access to the configured Pinot cluster. This issue has been fixed in version 3.1.0
Articles & Coverage 2
AnalysisAI
Authentication bypass in StarTree mcp-pinot versions 3.0.1 and earlier exposes the Model Context Protocol HTTP server on 0.0.0.0:8080 by default with no authentication, allowing any network-adjacent attacker to invoke every MCP tool - including SQL execution, schema creation, and table-config mutation - against the backing Apache Pinot cluster using the server's own credentials. The maximum CVSS 10.0 score reflects a scope-changing confused-deputy condition. No public exploit identified at time of analysis, but the trivial reachability and presence of write/DDL tooling make exploitation straightforward once the port is found.
Technical ContextAI
mcp-pinot is a Python-based MCP (Model Context Protocol) server developed by StarTree that bridges LLM clients to Apache Pinot, an OLAP datastore. The vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function): a prior PR introduced HTTP/SSE transport for Kubernetes deployment but shipped with MCP_HOST=0.0.0.0, MCP_PORT=8080, MCP_TRANSPORT=both, and no OAuth requirement, exposing tool endpoints such as /api/tools/call and /sse to anyone who can reach the listening interface. Because the server holds upstream Pinot credentials and forwards calls server-side, it acts as a deputy that confers its privileges to any anonymous caller - a classic confused-deputy pattern. Affected CPE is cpe:2.3:a:startreedata:mcp-pinot:*:*:*:*:*:*:*:* up to and including 3.0.1.
RemediationAI
Vendor-released patch: upgrade to mcp-pinot 3.1.0 or later, which changes the default MCP_HOST to 127.0.0.1, refuses non-loopback HTTP binds unless OAuth is enabled, and adds sqlglot-based read-query validation that rejects non-SELECT, stacked, and DDL/admin SQL before forwarding to Pinot (see PR https://github.com/startreedata/mcp-pinot/pull/95 and commit https://github.com/startreedata/mcp-pinot/commit/1c7d3f9cd384854bf72c127d230bdb32299475ad). If immediate upgrade is not possible, set MCP_HOST=127.0.0.1 and MCP_TRANSPORT=stdio to disable network exposure (trade-off: breaks remote/Kubernetes clients), or place the server behind an authenticated reverse proxy / network policy that restricts ingress to trusted client identities (trade-off: requires careful identity binding so the proxy does not itself become a confused deputy). Rotate any Pinot credentials configured in the server, since prior unauthenticated callers may already have used them, and audit Pinot for unexpected schema, table-config, or data changes.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today