Read the docs
TI-2026-36453 Aliases CVE-2026-49257GHSA-73cv-556c-w3g6

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Priority HIGH 82CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and table-config mutation, are reachable by any network-adjacent caller. The server proxies these calls using server-side Pinot credentials, producing a confused-deputy condition that yields full read/write access to the configured Pinot cluster. This issue has been fixed in version 3.1.0

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00621 50th percentileScored 2026-11-07
Fix Fixed mcp-pinot (startreedata): 3.1.0mcp-pinot-server (PyPI): 3.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
startreedatamcp-pinotbefore 3.1.03.1.0Patch availableCNA
—mcp-pinot-server (PyPI)before 3.1.03.1.0Patch availableGHSA-73cv-556c-w3g6
  • mcp-pinot Vendorstartreedata Affected before 3.1.0 Fixed in 3.1.0 Patch available CNA
  • mcp-pinot-server (PyPI) Vendor— Affected before 3.1.0 Fixed in 3.1.0 Patch available GHSA-73cv-556c-w3g6

Remediation

  • Fix · CNA mcp-pinot (startreedata) Fixed in 3.1.0
  • Fix · GHSA-73cv-556c-w3g6 mcp-pinot-server (PyPI) Fixed in 3.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49257
  2. 2026-10-03 Alias added: GHSA-73cv-556c-w3g6
  3. 2026-10-27 EPSS moved to the below the 50th percentile
  4. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences