CVE-2024-49587

Glutton V1 endpoints missing authentication

State: Published
Severity: 9.1 Critical
Published: Dec 19, 2025
Updated: Feb 26, 2026
Reserved: Oct 16, 2024

Description

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	Palantir

Weaknesses

CWE-305 The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Affected Products

Product	Versions
com.palantir.gotham:gluttonPalantir	105.95.0 and laterNot affected

References

https://palantir.safebase.us/?tcuUid=95e2d805-dd2f-4544-b164-e61100f47b11

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.