mcp-pinot MCP server exposes full Pinot cluster access with no authentication by default

Undisclosed·mcp-pinot (Model Context Protocol server for Apache Pinot)Fixed

mcp-pinot versions up to 3.0.1 defaulted to running its HTTP MCP transport bound to 0.0.0.0:8080 with OAuth disabled, so any network-adjacent caller could invoke all 14 exposed tools -- including read_query, create_schema, update_schema, create_table_config and update_table_config -- and the server executed them using its own server-side Pinot credentials (PINOT_TOKEN or username/password) rather than the caller's identity.

Blast radius

Any unauthenticated network caller with access to the server's port could read arbitrary table data, enumerate cluster schemas and metadata, create or mutate schemas and table configs, and degrade cluster availability via expensive queries or malformed configuration -- full read/write compromise of the underlying Apache Pinot cluster. No specific victim deployments or record counts were disclosed.

Root cause

Three insecure defaults composed together: oauth_enabled=False by default, auth object left as None so FastMCP registered all tool endpoints unauthenticated, and the HTTP transport bound to 0.0.0.0:8080 (all interfaces) rather than loopback -- a classic confused-deputy where the MCP server used its own privileged service-account credentials to service requests from callers it never authenticated.

How it was caught

Found and reported by independent security researchers (raysabee and PeledTomer1) via GitHub Security Advisory disclosure on 2026-05-23, not caught by any deployer before disclosure; the maintainer (xiangfu0) published the advisory and shipped a fix two days later.

What changed

Fixed in v3.1.0 (released 2026-05-25, PR #95, commit 1c7d3f9): default HTTP bind host changed to 127.0.0.1, non-loopback HTTP/HTTPS exposure refused unless OAuth is enabled, Helm chart exposure made opt-in and OAuth-gated, and parser-backed single-statement read-only validation added for read_query.

Take-awayNever ship a network-facing MCP server with authentication opt-in and a default bind of 0.0.0.0 -- default to loopback-only and fail closed (refuse to start) whenever a non-loopback bind is requested without auth enabled.