CVE-2022-27891

Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.

State: Published
Severity: 5.3 Medium
Published: Feb 16, 2023
Updated: Mar 18, 2025
Reserved: Mar 25, 2022

Read the record on cve.org

Description

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected services to the latest version. This issue affects: Palantir Gotham versions prior to 103.30221005.0.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Palantir

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
GothamPalantir	before 3.22.10.4Affected

References

https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-10.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.