Palantir Gotham Gaia Unauthenticated Endpoint Vulnerability

A vulnerability exists in the Palantir Gotham Gaia application, where multiple endpoints are exposed without authentication. This issue arises from a misconfiguration during a framework migration, allowing a malicious user with knowledge of specific resource IDs to access data without authentication. The affected resource identifiers are randomly generated, making it unlikely to brute force or guess them. However, an internal audit found no evidence of abuse.

Impact

Exploitation of this vulnerability could lead to unauthorized data access through the unauthenticated endpoints.

Remediation

The impacted endpoints have been fixed by implementing strict authentication and authorization checks.