CVE-2026-49257

Summary of CVE-2026-49257 – mcp-pinot : Versions 3.0.1 and earlier run an HTTP MCP server bound to 0.0.0.0:8080 with no authentication, exposing all MCP tools (SQL query execution, schema creation, table-config mutation) to any network-adjacent caller. The server proxies these calls using server-...

CVE-2026-49257 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and...

CVE-2026-49257 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and...

PT-2026-50795

Name of the Vulnerable Software and Affected Versions mcp-pinot versions prior to 3.1.0 Description mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. The software defaults to running an HTTP MCP server bound to 0.0.0.0:8080 without authentication. Th...

CVE-2026-50010 vulnerabilities

Vulnerabilities for packages: apache-pulsar, reposilite, kafbat-ui, spark-kubernetes-operator, apache-pulsar-fips, kserve-modelmesh, spark, spark-kubernetes-operator-fips, thingsboard, opensearch, neo4j, infinispan, kafbat-ui-fips, kafka, celeborn, elasticsearch-fips, hadoop-fips,...

GHSA-C653-97M9-RCG9 vulnerabilities

Vulnerabilities for packages: apache-pulsar, reposilite, kafbat-ui, spark-kubernetes-operator, apache-pulsar-fips, kserve-modelmesh, spark, spark-kubernetes-operator-fips, thingsboard, opensearch, neo4j, infinispan, kafbat-ui-fips, kafka, celeborn, elasticsearch-fips, hadoop-fips,...

GHSA-5W86-C3RQ-VJJ7 vulnerabilities

Vulnerabilities for packages: seata, pinot-fips, celeborn, hadoop-fips, management-api-for-apache-cassandra-5.0, thingsboard...

CVE-2026-50011 vulnerabilities

Vulnerabilities for packages: seata, pinot-fips, celeborn, hadoop-fips, management-api-for-apache-cassandra-5.0, thingsboard...

CVE-2026-45300 vulnerabilities

Vulnerabilities for packages: apache-pulsar, pinot, pinot-fips, druid, apache-pulsar-fips, tez...

GHSA-FMXF-PM6P-7XGM vulnerabilities

Vulnerabilities for packages: apache-pulsar, pinot, pinot-fips, druid, apache-pulsar-fips, tez...

CVE-2026-44248 vulnerabilities

Vulnerabilities for packages: trino, apache-hop, management-api-for-apache-cassandra-4.0, seata, apache-activemq-artemis, hono, celeborn, management-api-for-apache-cassandra-4.1, hadoop-fips, druid, pinot, pinot-fips, management-api-for-apache-cassandra-5.0, tez, apache-hop-fips, thingsboard...

GHSA-JFG9-48MV-9QGX vulnerabilities

Vulnerabilities for packages: trino, apache-hop, management-api-for-apache-cassandra-4.0, seata, apache-activemq-artemis, hono, celeborn, management-api-for-apache-cassandra-4.1, hadoop-fips, druid, pinot, pinot-fips, management-api-for-apache-cassandra-5.0, tez, apache-hop-fips, thingsboard...

GHSA-RGRR-P7GP-5XJ7 vulnerabilities

Vulnerabilities for packages: trino, apache-hop, management-api-for-apache-cassandra-4.0, seata, pinot, management-api-for-apache-cassandra-4.1, celeborn, pinot-fips, hadoop-fips, druid, management-api-for-apache-cassandra-5.0, tez, apache-hop-fips, thingsboard...

CVE-2026-42586 vulnerabilities

Vulnerabilities for packages: trino, apache-hop, management-api-for-apache-cassandra-4.0, seata, pinot, management-api-for-apache-cassandra-4.1, celeborn, pinot-fips, hadoop-fips, druid, management-api-for-apache-cassandra-5.0, tez, apache-hop-fips, thingsboard...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: apache-jena-fuseki, kafka-bridge, apache-pulsar, nuxeo, apache-activemq-fips, kafka-bridge-fips, spark-kubernetes-operator, apache-pulsar-fips, strimzi-kafka-operator, apache-camel-karavan-devmode, kserve-modelmesh, spark, spark-kubernetes-operator-fips,...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: apache-jena-fuseki, kafka-bridge, apache-pulsar, nuxeo, apache-activemq-fips, kafka-bridge-fips, spark-kubernetes-operator, apache-pulsar-fips, strimzi-kafka-operator, apache-camel-karavan-devmode, kserve-modelmesh, spark, spark-kubernetes-operator-fips,...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: kafka-bridge, trino, apache-pulsar, reposilite, hono, kafbat-ui, kafka-bridge-fips, strimzi-kafka-operator, apache-pulsar-fips, apache-camel-karavan-devmode, kserve-modelmesh, localstack, spark, thingsboard, keycloak-fips, neo4j, opensearch-fips, infinispan,...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: kafka-bridge, trino, apache-pulsar, reposilite, hono, kafbat-ui, kafka-bridge-fips, strimzi-kafka-operator, apache-pulsar-fips, apache-camel-karavan-devmode, kserve-modelmesh, localstack, spark, thingsboard, keycloak-fips, neo4j, opensearch-fips, infinispan,...

CVE-2026-33870 vulnerabilities

Vulnerabilities for packages: kafka-bridge, trino, apache-pulsar, reposilite, hono, kafbat-ui, kafka-bridge-fips, strimzi-kafka-operator, apache-pulsar-fips, apache-camel-karavan-devmode, kserve-modelmesh, localstack, spark, thingsboard, keycloak-fips, opensearch, neo4j, opensearch-fips,...

CVE-2025-33042 vulnerabilities

Vulnerabilities for packages: apache-hop, apache-pulsar, kafbat-ui-fips, pinot, celeborn, hadoop-fips, druid, kafbat-ui, spark-fips, wavefront-proxy, apache-hop-fips, spark, akhq, logstash...