CVE-2026-49257: CWE-306: Missing Authentication for Critical Function in startreedata mcp-pinot - Live Threat Intelligence - Threat Radar | OffSeq.com

What it is

CVE-2026-49257 — a CVSS 10.0 missing-authentication flaw (CWE-306) in startreedata's mcp-pinot, a Python-based Model Context Protocol server for Apache Pinot. Affects versions 3.0.1 and below; fixed in 3.1.0.

How it works

By default, mcp-pinot starts an HTTP MCP server bound to 0.0.0.0:8080 with no authentication. Every MCP tool it exposes — SQL query execution, schema creation, and table-config mutation — is reachable by any network-adjacent caller. The server proxies each call to the backing Pinot cluster using server-side Pinot credentials, so an unauthenticated caller inherits those credentials. This is a confused-deputy condition: the attacker needs no Pinot credentials of their own, only network reach to the MCP port, and gains full read/write access to the configured cluster.

flowchart LR
  A[Network-adjacent caller<br/>no auth] --> B[mcp-pinot :8080<br/>0.0.0.0, no auth]
  B -->|server-side<br/>Pinot creds| C[Apache Pinot cluster<br/>full read/write]
  D[Upgrade to 3.1.0<br/>OR restrict network] -.cuts.-> B

Preconditions / Affected

• mcp-pinot ≤ 3.0.1 running with its default HTTP binding.
• The server reachable on 0.0.0.0:8080 from an attacker's network position (LAN, adjacent segment, or exposed interface).
• No additional privileges or credentials required of the attacker.

What to do

• Upgrade to mcp-pinot 3.1.0 or later, where authentication is enforced for all MCP functions.
• Until upgraded, restrict network access to the mcp-pinot server to trusted users only (firewall/bind to loopback or a trusted interface). The page notes no official patch or workaround exists beyond the version upgrade.

Caveats

The impact rating (complete confidentiality, integrity, and availability loss; CVSS 10.0) and analysis are machine-generated ("AI-Powered Analysis") on OffSeq's Threat Radar, derived from the GitHub-assigned advisory. The affected-version and fix-version boundaries come directly from the vendor description; treat the surrounding impact prose as enrichment rather than independent verification.