CVE-2026-49257: mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Synopsis

An authentication bypass vulnerability in mcp-pinot (versions 3.0.1 and below) allows any caller reachable over the network to invoke all MCP tool endpoints without credentials. The server binds by default to 0.0.0.0:8080 with OAuth disabled, and it proxies requests using its own server-side Pinot credentials, creating a confused-deputy condition. Successful exploitation gives an unauthenticated attacker full read and write access to the connected Apache Pinot cluster, including arbitrary SQL execution and schema or table-config mutation. A patched-image rebuild at version 3.1.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The server binds to 0.0.0.0:8080 by default, so an attacker must be able to reach that port over the network; any host with TCP access to the exposed interface can exploit this.

• AuthenticationNot required

  OAuth is disabled by default (oauth_enabled=False), so no credentials, tokens, or account of any privilege level are required to invoke MCP tools.

• Victim interactionNot required

  The attacker sends HTTP requests directly to the listening server; no user action or social engineering is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free: the default configuration exposes the service without any race conditions, memory-layout dependencies, or environmental prerequisites.

Blast Radius

• Reads any data stored in the connected Apache Pinot cluster, including all tables, schemas, and query results, by issuing arbitrary SQL SELECT statements through the unauthenticated tool endpoint.
• Modifies persisted Pinot table configurations and schemas, allowing an attacker to alter data structures, drop tables, or corrupt ingestion pipelines.
• Executes arbitrary SQL write operations against Pinot using the server's own privileged credentials, inserting or deleting records across all accessible tables.
• Disrupts cluster availability by submitting resource-exhausting queries or destructive administrative commands that the server proxy forwards with full server-side authority.