Exposed Service Endpoints in Gotham Stacks Affecting Glutton V1 by Palantir

CVE-2024-49587

What is CVE-2024-49587?

The Glutton V1 service endpoints on Gotham stacks were found to be exposed without proper authentication mechanisms. This vulnerability allowed unauthorized users to directly access the backend of the Glutton service, enabling them to read, update, and delete sensitive data. Palantir has promptly patched the affected service, ensuring that all Apollo-managed Gotham instances are secured against this flaw.

References