Skip to content

Back to the catalog

Vulnerability-Lookup
vulnerability.circl.luadvisory

Vulnerability-Lookup

GHSA-73cv-556c-w3g6 (CVE-2026-49257, CWE-306) documents that mcp-pinot v3.0.1 and earlier defaults to an HTTP MCP server bound to 0.0.0.0:8080 with oauth_enabled=False, exposing all 14 tools — including read_query, create_schema and create_table_config — to any unauthenticated network caller. The server proxies calls using its own server-side Pinot credentials, creating a confused-deputy condition that grants full read/write access to the backing Apache Pinot cluster (CVSS 10.0). Fixed in v3.1.0 (PR #95) by defaulting the bind host to 127.0.0.1, refusing non-loopback exposure without OAuth, and gating Helm exposure behind OAuth.

TL;DR mcp-pinot's default 0.0.0.0:8080 bind with OAuth off let unauthenticated callers read/write an entire Pinot cluster via server-side credentials — CVSS 10.0, fixed in v3.1.0.
Open original ↗
Document

What it is

GHSA-73cv-556c-w3g6 (CVE-2026-49257) in mcp-pinot, the Pinot MCP server from startreedata, distributed on PyPI as mcp-pinot-server. Affected: all releases on main, confirmed across tags v2.1.0 through v3.0.1; fixed in v3.1.0 (released 2026-05-25, PR #95, commit 1c7d3f9). The summary already has the mechanism and CVSS 10.0 — what follows is the exploit shape, the immediate workaround, and the version boundary an operator needs.

How it works

Three independent defaults compose into unauthenticated remote access. In config.py: oauth_enabled defaults to False, and host defaults to 0.0.0.0 on port 8080. In server.py:26-46, auth is only constructed when oauth_enabled is true — otherwise _auth stays None and FastMCP registers every @mcp.tool with no auth. Following the README's HTTP-transport instructions verbatim lands you here.

What to do

Upgrade to v3.1.0. It defaults the bind host to 127.0.0.1, refuses non-loopback HTTP/HTTPS unless OAuth is on, makes Helm exposure opt-in and OAuth-gated, and adds parser-backed single-statement read-only validation for read_query.

Immediate mitigation without upgrading: set MCP_HOST=127.0.0.1 (drops attack vector to Local) or set OAUTH_ENABLED=true. The advisory also proposes a fail-closed guard in main():

def _is_loopback(host: str) -> bool:
    return host in {"127.0.0.1", "::1", "localhost"}

if server_config.transport != "stdio" and not server_config.oauth_enabled and not _is_loopback(server_config.host):
    raise SystemExit("Refusing to start: HTTP transport bound to non-loopback host without OAuth.")

Detect/confirm exposure with an unauthenticated call — a response means you are vulnerable:

curl -X POST http://victim:8080/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_tables","arguments":{}},"id":1}'

The same path reaches read_query (arbitrary SELECT) and create_schema (writes), executed with the server's PINOT_TOKEN/PINOT_USERNAME. Note test_connection leaks host/port/scheme/database/auth-mode, and reload_table_filters returns both previous_filters and new_filters.

Caveats

The MCP_HOST=127.0.0.1 workaround only lowers CVSS AV to Local — it does not address auth for legitimately network-facing deployments, which still need OAuth. NVD published 2026-06-18; GitHub reviewed 2026-06-26.

CVEs named here

Technologies named here

Techniques named here

Related in AI Security