What is CVE-2024-49587?

CVE-2024-49587 is a critical-severity vulnerability in Palantir Com.palantir.gotham:glutton, classified under Authentication Bypass by Primary Weakness. CVSS score: 9.1/10. Published 2025-12-19.

How severe is CVE-2024-49587?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Palantir Com.palantir.gotham:glutton

CVE-2024-49587

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances

EPSS: 0.003 (21.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Palantir Com.palantir.gotham:glutton — versions 105.95.0

Weakness classification (CWE)

CWE-305 — Authentication Bypass by Primary Weakness

References

cve-coordination@palantir.com

Frequently asked questions

What is CVE-2024-49587?: CVE-2024-49587 is a critical-severity vulnerability in Palantir Com.palantir.gotham:glutton, classified under Authentication Bypass by Primary Weakness. CVSS score: 9.1/10. Published 2025-12-19.
How severe is CVE-2024-49587?: Critical severity. CVSS v3 base score is 9.1 out of 10.