CVE-2026-49257 Google Chronicle · YARA-L

Detect CVE-2026-49257: mcp-pinot Unauthenticated Tool Invocation via Default oauth_enabled=False in Google Chronicle

Detects exploitation of CVE-2026-49257, a critical authentication bypass in mcp-pinot-server (<=3.0.1). The server defaults to oauth_enabled=False and binds to 0.0.0.0, allowing any network-adjacent or internet-facing attacker to invoke MCP tools without authentication. CVSS 10.0 with public PoC available.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Exfiltration

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_49257_mcp_pinot_unauth_invocation {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects unauthenticated tool invocation against mcp-pinot-server (CVE-2026-49257)"
    severity = "CRITICAL"
    reference = "https://github.com/startreedata/mcp-pinot/security/advisories/GHSA-73cv-556c-w3g6"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST"
    (
      $e.network.http.target_url = /\/tools\// or
      $e.network.http.target_url = /\/invoke/ or
      $e.network.http.target_url = /\/call/
    )
    not $e.network.http.request_headers["authorization"] != ""
    (
      $e.target.port = 8000 or
      $e.target.port = 8080 or
      $e.target.port = 9000 or
      $e.target.port = 3000
    )
    (
      $e.principal.process.command_line = /mcp.?pinot/ or
      $e.target.hostname = /mcp.?pinot/
    )

  condition:
    $e
}
critical severity medium confidence

Chronicle YARA-L rule detecting HTTP POST requests to mcp-pinot tool invocation endpoints without Authorization headers on common MCP server ports, matching CVE-2026-49257 exploitation patterns.

Data Sources

Chronicle UDMGCP HTTP load balancer logsEndpoint telemetry

Required Tables

UDM network events

False Positives & Tuning

  • Internal GCP service-to-service calls authenticated via IAM rather than bearer tokens
  • Log sources not capturing HTTP request header details in UDM
  • Development environments with authentication intentionally disabled
  • Proxy infrastructure stripping auth headers before ingestion into Chronicle

Other platforms for CVE-2026-49257

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Verify Unauthenticated MCP Tool Listing

    Expected signal: HTTP 200 response with JSON list of available Pinot MCP tools returned without any authentication challenge; no 401 or 403 status code issued.

  2. Test 2Unauthenticated Pinot Query Execution via MCP Tool

    Expected signal: Pinot query execution log entry showing query 'SELECT * FROM myTable LIMIT 10' from MCP server without session token; HTTP 200 from mcp-pinot-server with query results in response body.

  3. Test 3External Network Exploitation Simulation

    Expected signal: Inbound TCP connection from external IP to port 8000; HTTP POST to /tools/list and /tools/call with source IP from outside trusted ranges; no TLS client certificate or Authorization header present.

  4. Test 4Confirm Vulnerable Package Version in Environment

    Expected signal: Command execution events showing pip, find, and ps commands with mcp-pinot arguments; output revealing package version <= 3.0.1 and running process details.

Last updated: 2026-06-27 Research depth: standard
References (6)

Unlock Pro Content

Get the full detection package for CVE-2026-49257 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0010Exfiltration

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.006PythonT1041Exfiltration Over C2 Channel

Same Tactic: Initial Access

Popular Detections