CVE Intelligence
Analysis AI-assisted

CVE-2026-49257: mcp-pinot MCP server exposes unauthenticated HTTP endpoint with full Apache Pinot access

mcp-pinot, a Python MCP server for Apache Pinot, defaults in versions 3.0.1 and below to an HTTP server bound to 0.0.0.0:8080 with no authentication. Any reachable caller can invoke tools for SQL queries, schema creation and table-config changes using the server's own Pinot credentials. The issue is rated CVSS 3.1 10.0 and is fixed in version 3.1.0.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-49257 affects mcp-pinot, a Python-based Model Context Protocol (MCP) server maintained in the startreedata GitHub organization that lets MCP clients interact with Apache Pinot. In versions 3.0.1 and below, the default configuration starts an HTTP MCP server listening on 0.0.0.0:8080 with no authentication. The weakness is classified as CWE-306 (Missing Authentication for Critical Function).

Impact

Because the listener binds to all interfaces and requires no credentials, any caller who can reach the port can invoke every exposed MCP tool, including SQL query execution, schema creation and table-config mutation. The server forwards these requests using its own server-side Pinot credentials, creating a confused-deputy condition: unauthenticated callers effectively inherit the server's privileges and gain full read and write access to the configured Pinot cluster. Practical consequences can include data disclosure, data or schema tampering and disruption of analytics workloads.

The GitHub CNA assigned a CVSS 3.1 base score of 10.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reflecting network reachability, low complexity, no privileges or user interaction, and changed scope.

Affected products and versions

  • mcp-pinot versions 3.0.1 and below (per the CVE description)
  • Fixed in mcp-pinot 3.1.0

The record does not include structured affected-version or package data beyond the description.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Given the trivial preconditions, exposed instances should be treated as high risk regardless.

Remediation and mitigation

  • Upgrade mcp-pinot to 3.1.0 or later. See the GitHub advisory, the fix pull request and the related commit.
  • Until upgraded, avoid exposing the HTTP transport: bind it to localhost or restrict port 8080 with host or network firewalls.
  • Grant the Pinot credentials used by the MCP server only the minimum privileges required, ideally read-only where writes are not needed.
  • Rotate Pinot credentials used by any instance that may have been exposed.
  • Review the original issue for context on the default configuration.

Detection guidance

  • Inventory hosts running mcp-pinot and check whether port 8080 is reachable from other systems or networks.
  • Review network logs for unexpected connections to the MCP server's HTTP port.
  • Audit Pinot cluster logs and metadata for unexpected schema creation, table-config changes or unusual query activity attributed to the MCP server's service account.

Limitations of the available information

The NVD record is in Deferred status and contains no structured affected-product configuration, EPSS or SSVC data. Details on how version 3.1.0 enforces authentication or changes the default binding were not reviewed beyond the referenced links, so administrators should confirm the secure configuration after upgrading.

Frequently asked questions

Which mcp-pinot versions are affected by CVE-2026-49257?

Versions 3.0.1 and below are affected according to the CVE description; the issue is fixed in version 3.1.0.

Why is the severity rated 10.0?

The default HTTP server listens on all interfaces without authentication, and it executes requests with its own Pinot credentials, giving any reachable caller full read/write access to the Pinot cluster with changed scope.

Is CVE-2026-49257 being exploited in the wild?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What can I do if I cannot upgrade immediately?

Restrict the HTTP listener to localhost or block port 8080 at the network level, limit the privileges of the Pinot credentials used by the server, and rotate credentials for instances that may have been exposed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.