Vendor
Palantir
47 known vulnerabilities.
Palantir at a glance
- Last 12 months
- 6
- Critical · all time
- 3
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 2 | 0 |
| Dec 2025 | 4 | 1 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 1 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 1 | 0 |
Products
47 results · Feed
-
Medium 6.6
Authentication bypass in Aries due to misconfiguration
A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potenti…
-
Low 3.5
Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files.
On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be…
-
Medium 6.8
Gaia unauthenticated endpoints
Gotham Gaia application was found to be exposing multiple unauthenticated endpoints.
-
Critical 9.1
Glutton V1 endpoints missing authentication
Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automa…
-
High 7.5
Network boundaries not respected in certain Foundry namespaces.
Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This issue resulted in bypass of access control due to the presence of a vulnerable endpoint in Foundry Co…
-
Medium 4.1
Insufficient permission checks when pre-enrolling users Summary
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missin…
-
Medium 5.4
Access control issues impacting secure-upload service
Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments. Under specific circumstances, privileged users of secure-upload could have select…
-
Medium 6.5
Foundry artifacts denial of service
Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size).
-
Medium 6.5
Access control issue impacting RV backed objects
Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not imp…
-
Medium 6.8
Multiple authenticated SQL injections in oracle-sidecar
Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections.
-
Medium 6.8
Stored XSS in gaia
One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP and get a persistent cross site scripting payload on the stack.
-
Low 3.5
In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants.
In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the rest of the stack’s tenants.
-
Medium 6.5
Gotham table and Forward App Path traversal
Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system.
-
Low 2.7
Gotham Video Broken Authentication
The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized.
-
Critical 9.8
Gotham Orbital Simulator path traversal
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system.
-
High 8.2
Palantir Tiles missing authentication on API endpoints
The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.
-
Medium 6.5
Palantir Gotham UI bug that could lead to incorrect data classification
Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.
-
Medium 4.1
Stored XSS via javascript URI in Apollo Change Requests comment
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.
-
Medium 6.8
Stored XSS in cerberus attachments
The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd5…
-
Medium 5.0
Foundry Issues reporterPath phishing by parameter injection
A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 .
-
Medium 6.5
CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
-
Medium 4.7
DOM XSS in Developer mode dashboard via redirect GET parameter
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0.
-
Medium 6.3
CVE-2023-30951
The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).
-
Medium 4.3
CVE-2023-30949
A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks.
-
Medium 5.3
IDOR in Foundry Comments allows retrieval of attachments
A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comme…
-
Medium 4.3
Insecure Direct Object Reference (IDOR) in Foundry job-tracker
A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affect…
-
Medium 5.4
Stored XSS in Foundry Slate Query Dropdown menu
A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affe…
-
High 7.7
Denial of Service in Foundry Issues
A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants. This defect was resolved with the relea…
-
Low 3.5
Issues notification metadata lacks authorization
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the R…
-
Medium 4.3
Foundry workspace-server Developer Mode Authorization Bypass
A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mod…
-
Low 2.7
The contour service was not checking that users had permission to create an analysis for a given dataset
The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.
-
Critical 9.8
CVE-2023-30945
Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker co…
-
High 7.6
Mandatory control bypass in Lime2
Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circumstances.
-
Medium 6.5
Retrieval of Attachments to Comments lacks Authorization
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbi…
-
Medium 5.3
Palantir Gotham included an endpoint that would log arbitrary sized payloads.
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service.
-
Medium 5.3
Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.
Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that…
-
Medium 6.3
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net…
-
Medium 5.3
Palantir Gotham included an endpoint that would log arbitrary sized zip files.
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources …
-
Medium 6.3
It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.ne…
-
Medium 5.7
Gotham Chat IRC help does not validate hostnames in TLS certificates
Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middl…