CVE-2026-49257 Details
Description
mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and table-config mutation, are reachable by any network-adjacent caller. The server proxies these calls using server-side Pinot credentials, producing a confused-deputy condition that yields full read/write access to the configured Pinot cluster. This issue has been fixed in version 3.1.0
A vulnerability in mcp-pinot versions 3.0.1 and prior allows unauthenticated execution of arbitrary SQL queries on the Apache Pinot database. This issue arises because the server, by default, binds to all network interfaces (0.0.0.0) on port 8080, without any authentication. As a result, any network-adjacent caller can access the server's MCP tools, including the 'read-query' function, which is intended for executing SQL queries on Pinot. The vulnerability creates a 'confused-deputy' scenario, where the server-side credentials are misused to perform unauthorized actions on the Pinot cluster.
Users can upgrade to mcp-pinot version 3.1.0, which addresses this vulnerability by changing the default bind address to 127.0.0.1, enabling OAuth authentication, and adding validation to the 'read-query' tool to prevent unauthorized SQL execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/startreedata/mcp-pinot/security/advisories/GHSA-73cv-556c-w3g6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/startreedata/mcp-pinot/commit/1c7d3f9cd384854bf72c127d230bdb32299475ad | [email protected] | Source CodeVendor |
| https://github.com/startreedata/mcp-pinot/issues/90 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/startreedata/mcp-pinot/pull/95 | [email protected] | Source CodeVendor |
| https://github.com/startreedata/mcp-pinot/security/advisories/GHSA-73cv-556c-w3g6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| startreedata mcp-pinot | <= 3.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |