CVE-2026-49257 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
Unauthenticated attackers can execute SQL queries and modify schemas in Apache Pinot clusters via the mcp-pinot server due to default insecure settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49257?
CVE-2026-49257 is a critical missing authorization vulnerability in startreedata mcp-pinot, published on 18 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and table-config mutation, are reachable by any network-adjacent caller. The server proxies these calls using server-side Pinot credentials, producing a confused-deputy condition that yields full read/write access to the configured Pinot cluster. This issue has been fixed in version 3.1.0
Weakness: CWE-306
Which versions are affected by CVE-2026-49257?
3 open source packages ship an affected version, including mcp-pinot-server.
| Package | Affected | Fixed in |
|---|---|---|
mcp-pinot-server PyPI | All versions | 3.1.0 |
mcp-pinot-server PyPI | All versions | 3.1.0 |
mcp-pinot-server PyPI | All versions | 3.1.0 |
How do I fix CVE-2026-49257?
Upgrade mcp-pinot-server to 3.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-49257 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49257 exists.
Sources
Also known as GHSA-73cv-556c-w3g6, PYSEC-2026-410.