CVE-2024-49587

critical · 9.1

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances

9.1

CVSS

0.3%

EPSS (exploit prob.)

26th

EPSS percentile

2025-12-19

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-305

References

https://palantir.safebase.us/?tcuUid=95e2d805-dd2f-4544-b164-e61100f47b11

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-49587