VulnSocial

CVE-2026-49257Disclosure

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

Back to dashboard
0.5/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 3d ago at 1 mentions (2026-06-18); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-06-18: 1Mentions · 2026-06-23: 1Mentions · 2026-06-26: 1Mentions · 2026-06-28: 1Patch / Workaround · 2026-06-23: 1Patch / Workaround · 2026-06-28: 1Technical Details · 2026-06-18: 1Technical Details · 2026-06-23: 1Technical Details · 2026-06-26: 1Technical Details · 2026-06-28: 106-1806-2306-2606-28
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-181
Disclosure1
2026-06-231
Disclosure1
2026-06-261
Disclosure1
2026-06-281
Patch1
Full discourse4 posts
  • DailyCVE@dailycve
    Disclosure

    🔴 mcp-pinot, Unauthenticated Remote Code Execution via Default Configuration, #CVE-2026-49257 (Critical) -DC-Jun2026-701 https://dailycve.com/mcp-pinot-unauthenticated-remote-code-execution-via-default-configuration-cve-2026-49257-critical-dc-jun2026-701/

    Post summary

    The text announces a new critical vulnerability, CVE-2026-49257, in mcp-pinot that enables unauthenticated remote code execution through a default configuration.

    0001038
    216 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    CVE-2026-49257: CVSS 10 critical in mcp-pinot-server 🍍 No auth, network-accessible, full RCE impact (C/H I/H A/H). Patch to v3.1.0 now. https://secalerts.co/vulnerability/GHSA-73cv-556c-w3g6?utm_campaign=x https://t.co/Vr46IOKdSA

    Post summary

    The tweet announces CVE‑2026‑49257 with a CVSS 10 critical RCE, provides brief technical details, and highlights that a patch is available in version 3.1.0, but does not mention active exploitation or a PoC.

    00000103
    846 followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    🔓 mcp-pinot binds to 0.0.0.0:8080 with auth OFF by default — anyone on the network can invoke tools unauthenticated. CVE-2026-49257, CVSS 10. Affects v3.0.1 and below. Upgrade now. https://secalerts.co/vulnerability/CVE-2026-49257?utm_campaign=x https://t.co/v5qzY0Kwcb

    Post summary

    The tweet announces that mcp-pinot exposes CVE‑2026‑49257 by binding to 0.0.0.0:8080 without authentication (CVSS 10), affecting v3.0.1 and below, and urges users to upgrade.

    0000096
    842 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-49257 Unauthenticated Remote Access to Apache Pinot via mcp-pinot Versions 3.0.1 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49257

    Post summary

    The text announces CVE-2026-49257 as an unauthenticated remote access flaw in Apache Pinot (v3.0.1 and earlier), providing brief technical details but no PoC, exploit code, or mitigation information.

    0000045
    4.1K followersView on X

Explore more

Back to dashboard