CVE-2026-49257: mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
mcp-pinot v3.0.1 (and earlier) defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and table-config mutation, are reachable by any network-adjacent caller. The server proxies these calls using server-side Pinot credentials, producing a confused-deputy condition that yields full read/write access to the configured Pinot cluster.
References
- github.com/advisories/GHSA-73cv-556c-w3g6
- github.com/startreedata/mcp-pinot/commit/1c7d3f9cd384854bf72c127d230bdb32299475ad
- github.com/startreedata/mcp-pinot/issues/90
- github.com/startreedata/mcp-pinot/pull/95
- github.com/startreedata/mcp-pinot/security/advisories/GHSA-73cv-556c-w3g6
- nvd.nist.gov/vuln/detail/CVE-2026-49257
Code Behaviors & Features
Detect and mitigate CVE-2026-49257 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →