{"action":"Upgrade mcp-pinot-server to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"0"}],"component":"mcp-pinot-server","cve_ids":["CVE-2026-49257"],"ecosystem":"PyPI","epss":0.0093,"exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-73cv-556c-w3g6","id":"tcs_01M5KH9WHWF7DNKQFV65ESY2VH","modified_at":"2026-07-13T16:15:28.190826335Z","published_at":"2026-06-29T11:50:52.123329Z","references":["https://osv.dev/vulnerability/PYSEC-2026-410","https://github.com/startreedata/mcp-pinot/security/advisories/GHSA-73cv-556c-w3g6","https://nvd.nist.gov/vuln/detail/CVE-2026-49257","https://github.com/startreedata/mcp-pinot/issues/90","https://github.com/startreedata/mcp-pinot/pull/95","https://github.com/startreedata/mcp-pinot/commit/1c7d3f9cd384854bf72c127d230bdb32299475ad","https://github.com/startreedata/mcp-pinot","https://pypi.org/project/mcp-pinot-server","https://github.com/advisories/GHSA-73cv-556c-w3g6"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"PYSEC-2026-410","url":"https://osv.dev/vulnerability/PYSEC-2026-410"}],"summary":"mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind"}