CVE-2026-49257: mcp-pinot-server Authentication Bypass Allows Unauthenticated Tool Invocation (CVSS 10.0)

Vulnerability Overview

CVE-2026-49257 is a critical authentication bypass (CWE-306: Missing Authentication for Critical Function) in mcp-pinot-server, a Python package distributed via pip that exposes Apache Pinot data via the Model Context Protocol (MCP). The root cause is a dangerous default: oauth_enabled is set to False out of the box, and the server binds to 0.0.0.0, meaning any network-adjacent or internet-exposed host running the default configuration accepts unauthenticated MCP tool invocations from arbitrary clients. There is no authentication gate between an attacker and full tool execution. This vulnerability carries a CVSS score of 10.0 — the maximum possible — reflecting its trivial exploitability and complete lack of access controls.

Affected Software

• Package: mcp-pinot-server (pip / PyPI)
• Affected versions: <= 3.0.1
• Vendor: pip ecosystem

No patched version has been published as of the disclosure date (2026-06-26). Any deployment of mcp-pinot-server at version 3.0.1 or earlier with default configuration is vulnerable.

Exploitation Status

A public proof-of-concept (PoC) is available. This moves CVE-2026-49257 from theoretical to actively exploitable — any attacker with network access to the MCP server's bound interface can invoke tools without credentials. The combination of a CVSS 10.0 score, a public PoC, and a wildcard bind address (0.0.0.0) means internet-facing deployments are at immediate risk. Defenders should treat this as actively weaponized until evidence suggests otherwise and prioritize detection and mitigation now.

Detection Coverage

Our detection ships query logic across seven SIEM platforms, giving security teams coverage regardless of their logging stack:

• Microsoft Sentinel (KQL) — correlates MCP tool invocation events against expected authentication flows, flagging requests that bypass the OAuth gate
• Splunk (SPL) — identifies unauthenticated connections to the MCP server port combined with tool invocation activity in process and network telemetry
• Elastic (EQL) — sequence-based detection linking inbound network sessions to MCP tool execution without a preceding auth event
• IBM QRadar (AQL) — flow and log correlation targeting the default bind address pattern and absence of OAuth token exchange
• Sumo Logic — log search rules detecting MCP server startup with oauth_enabled=False and subsequent tool calls from non-local sources
• Chronicle (YARA-L) — rule matching on MCP protocol indicators combined with missing authentication metadata in network logs
• CrowdStrike (CQL) — endpoint telemetry queries detecting the mcp-pinot-server process binding to 0.0.0.0 with unauthenticated inbound connections

Detection logic focuses on three core signals: the server process binding to a wildcard interface, inbound connections to the MCP port from non-loopback sources, and tool invocations occurring without a preceding OAuth token exchange. High-confidence alerting can be achieved in environments with full network and process telemetry.

Recommendations

• Immediately restrict network access to the MCP server port via firewall or host-based controls.
• Set oauth_enabled=True in your mcp-pinot-server configuration and configure a valid OAuth provider.
• Bind the server to 127.0.0.1 or a private interface rather than 0.0.0.0 until a patched release is available.
• Audit logs for any unauthenticated tool invocations that may have occurred prior to detection deployment.

For the full detection rules across all seven supported SIEMs — including KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL — see the CVE-2026-49257 detection page. Free-tier users have access to the detection queries; purple team playbooks and atomic test cases are available to subscribers.