Palantir Gotham Glutton V1 Service Authentication Bypass Vulnerability Allowing Unauthorized Data Access

A vulnerability exists in the Glutton V1 service on Palantir Gotham stacks, where multiple endpoints were exposed without authentication or authorization. This flaw could have allowed users without the necessary permissions to directly access the Glutton backend and read, update, or delete data. The issue arose from a software bug during an infrastructure migration, which inadvertently allowed some code checks to pass without valid authentication. However, Palantir's Web Application Firewall would have blocked requests lacking a valid Authorization Header. The affected service has been patched and automatically deployed to all Apollo-managed Gotham instances.

Impact

Exploitation of this vulnerability could have led to unauthorized access and manipulation of data through the Glutton V1 service endpoints.