mcp-pinot is a Python‑based server that, in versions 3.0.1 and earlier, runs an HTTP MCP service bound to all interfaces with authentication turned off by default. This configuration exposes the full set of MCP tools—including query execution, schema manipulation, and table‑configuration changes—to any network‑adjacent client. Because the server forwards these calls using privileged server‑side Pinot credentials, an attacker can read and alter any data or configuration in the Pinot cluster, effectively achieving a confused‑deputy condition that amounts to full cluster compromise.

The vulnerability affects the product mcp-pinot from startreedata. All releases version 3.0.1 or earlier are impacted; the issue is fixed starting with version 3.1.0.

The CVSS score is 10, indicating a critical impact. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote network access to the exposed 8080 port on the MCP server; any client that can reach this endpoint can exploit the flaw without authentication.