{"id":"CVE-2024-49587","aliases":["EUVD-2024-55358","GHSA-4qrv-gcg3-8h65"],"status":"published","title":"Glutton V1 endpoints missing authentication","description":"Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00323,"percentile":0.2557,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-305"],"published":"2025-12-19T16:33:22Z","modified":"2026-06-17T08:00:00Z","products":[{"vendor":"palantir","product":"com.palantir.gotham:glutton"}],"references":[{"url":"https://palantir.safebase.us/?tcuUid=95e2d805-dd2f-4544-b164-e61100f47b11"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49587"},{"url":"https://github.com/advisories/GHSA-4qrv-gcg3-8h65"}],"sources":{"cve":[{"id":"CVE-2024-49587","title":"Glutton V1 endpoints missing authentication","description":"Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances","status":"published","published":"2025-12-19T16:33:22.971Z","modified":"2026-02-26T16:07:24.881Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:33:55.642267Z"}],"euvd":[{"id":"EUVD-2024-55358","description":"Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances","status":"published","published":"2025-12-19T16:33:22Z","modified":"2026-02-26T16:07:24Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:48:25.997368Z"}],"ghsa":[{"id":"GHSA-4qrv-gcg3-8h65","title":"Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could...","description":"Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances","status":"published","published":"2025-12-19T18:31:18Z","modified":"2025-12-19T18:31:29Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:05:18.038899Z"}],"nvd":[{"id":"CVE-2024-49587","description":"Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances","status":"published","published":"2025-12-19T17:15:50.643Z","modified":"2026-06-17T08:00:00.717Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:10:47.444899Z"}]}}