CVE-2026-49257: mcp-pinot Unauthenticated Tool Invocation via Default oauth_enabled=False

union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (8000, 8080, 8443, 9000, 3000)
| where (ProcessCommandLine has "mcp-pinot" or ProcessCommandLine has "mcp_pinot" or ProcessCommandLine has "uvicorn" or ProcessCommandLine has "fastapi")
| where not (InitiatingProcessAccountName in ("serviceaccount", "mcp-service"))
| extend AuthHeader = extract("Authorization: (\\S+)", 1, AdditionalExtensions)
| where isempty(AuthHeader) or AuthHeader == ""
| project TimeGenerated, DeviceName, RemoteIP, DestinationPort, ProcessCommandLine, InitiatingProcessAccountName, AuthHeader
| order by TimeGenerated desc

index=* sourcetype IN ("access_log", "nginx_access", "apache_access", "uvicorn", "python:app") 
| where match(_raw, "(?i)(mcp.pinot|mcp_pinot|/tools/|/invoke|/call)")
| rex field=_raw "\"(?P<http_method>GET|POST|PUT|DELETE|PATCH) (?P<uri_path>/[^\"]+)\""
| rex field=_raw "Authorization: (?P<auth_header>[^\r\n]+)"
| where isnull(auth_header) OR auth_header=""
| where http_method="POST" AND (match(uri_path, "/tools/") OR match(uri_path, "/invoke") OR match(uri_path, "/call"))
| stats count AS unauthenticated_invocations, values(uri_path) AS paths, values(src_ip) AS source_ips BY host
| where unauthenticated_invocations > 0
| sort -unauthenticated_invocations

network where event.type == "connection_attempted"
  and destination.port in (8000, 8080, 8443, 9000, 3000)
  and (
    process.name like~ "python*" or
    process.name like~ "uvicorn*" or
    process.command_line like~ "*mcp*pinot*" or
    process.command_line like~ "*mcp_pinot*"
  )
  and not source.ip == "127.0.0.1"
  and not source.ip like "10.*"
  and http.request.headers.authorization == null

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationport,
  username,
  "URL" AS request_uri,
  "HTTP Method" AS http_method,
  "Authorization Header" AS auth_header,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Linux OS', 'Python Application')
  AND destinationport IN (8000, 8080, 8443, 9000, 3000)
  AND ("URL" LIKE '%/tools/%' OR "URL" LIKE '%/invoke%' OR "URL" LIKE '%/call%')
  AND ("Authorization Header" IS NULL OR "Authorization Header" = '')
  AND "HTTP Method" = 'POST'
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=*web*access* OR _sourceCategory=*application*log* OR _sourceCategory=*python*
| where _raw matches /(?i)(mcp.?pinot|mcp_pinot|\/tools\/|\/invoke|\/call)/
| parse regex "\"(?P<method>POST|GET|PUT|DELETE) (?P<path>/[^\" ]+)" nodrop
| parse regex "Authorization:\s*(?P<auth_header>[^\r\n]+)" nodrop
| where method = "POST"
| where isNull(auth_header) or auth_header = ""
| where path matches /\/tools\/|\/invoke|\/call/
| count as unauthenticated_requests by _sourceHost, path, _sourceip
| sort by unauthenticated_requests desc

rule cve_2026_49257_mcp_pinot_unauth_invocation {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects unauthenticated tool invocation against mcp-pinot-server (CVE-2026-49257)"
    severity = "CRITICAL"
    reference = "https://github.com/startreedata/mcp-pinot/security/advisories/GHSA-73cv-556c-w3g6"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST"
    (
      $e.network.http.target_url = /\/tools\// or
      $e.network.http.target_url = /\/invoke/ or
      $e.network.http.target_url = /\/call/
    )
    not $e.network.http.request_headers["authorization"] != ""
    (
      $e.target.port = 8000 or
      $e.target.port = 8080 or
      $e.target.port = 9000 or
      $e.target.port = 3000
    )
    (
      $e.principal.process.command_line = /mcp.?pinot/ or
      $e.target.hostname = /mcp.?pinot/
    )

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=ProcessRollup2
| filter (
    ImageFileName = /python/i OR
    CommandLine = /mcp.?pinot/i OR
    CommandLine = /uvicorn/i
  )
| filter LocalPort in (8000, 8080, 8443, 9000, 3000)
| filter RemoteAddressIP4 != "127.0.0.1"
| join {
    #event_simpleName=NetworkReceiveAcceptIP4
    | filter HttpUri = /\/(tools|invoke|call)\//i
    | filter not HttpRequestHeaders = /Authorization:/i
  } [LocalPort, RemoteAddressIP4]
| stats count() AS unauthenticated_connections, values(HttpUri) AS uris BY ComputerName, RemoteAddressIP4, LocalPort
| sort -unauthenticated_connections