{"action":"Upgrade mcp-pinot-server to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"0"}],"component":"mcp-pinot-server","cve_ids":["CVE-2026-49257"],"ecosystem":"PyPI","epss":0.00621,"exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-73cv-556c-w3g6","id":"tcs_01M5KF4NHF0X9Q4GP8RM3233PF","modified_at":"2026-06-29T12:26:18.707917787Z","published_at":"2026-06-26T21:05:43Z","references":["https://osv.dev/vulnerability/GHSA-73cv-556c-w3g6","https://github.com/startreedata/mcp-pinot/security/advisories/GHSA-73cv-556c-w3g6","https://nvd.nist.gov/vuln/detail/CVE-2026-49257","https://github.com/startreedata/mcp-pinot/issues/90","https://github.com/startreedata/mcp-pinot/pull/95","https://github.com/startreedata/mcp-pinot/commit/1c7d3f9cd384854bf72c127d230bdb32299475ad","https://github.com/startreedata/mcp-pinot"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-73cv-556c-w3g6","url":"https://osv.dev/vulnerability/GHSA-73cv-556c-w3g6"}],"summary":"mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind"}