CVE-2025-68609
Authentication bypass in Aries due to misconfiguration
- State
- Published
- Severity
- 6.6 Medium
- Published
- Jan 22, 2026
- Updated
- Jan 22, 2026
- Reserved
- Dec 19, 2025
Description
A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible client to view system logs and perform operations without valid credentials. No evidence of exploitation was identified during the vulnerability window.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H | Palantir |
Weaknesses
- CWE-305 The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Affected Products
| Product | Versions |
|---|---|
com.palantir.aries:ariesPalantir |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.