Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17

Export CSV
CVE-2024-49581

Access control issue impacting RV backed objects

Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available across organizational boundaries nor did it allow for data to be viewed or accessed by unauthenticated users. The affected service have been patched and automatically deployed to all Apollo-managed Foundry instances.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry
CVE-2025-53710

Network boundaries not respected in certain Foundry namespaces.

Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This issue resulted in bypass of access control due to the presence of a vulnerable endpoint in Foundry Container Service that executed user-controlled commands locally.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Foundry Container Service
CVE-2022-27894

The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.

The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch attacks against other users. This vulnerability is resolved in Blobster 3.228.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Blobster
CVE-2022-27896

The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure.

Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python code being run. These service logs included the Foundry token that represents the Code-Workbooks Python console. Upgrade to Code-Workbooks version 4.461.0. This issue affects Palantir Foundry Code-Workbooks version 4.144 to version 4.460.0 and is resolved in 4.461.0.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Code-workbooks
CVE-2022-27895

A component in Foundry logging was found to be capturing sensitive information in logs.

Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Build2
CVE-2023-30948

Retrieval of Attachments to Comments lacks Authorization

A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's content. This defect was fixed in Foundry Comments 2.249.0, and a patch was rolled out to affected Foundry environments. No further intervention is required at this time.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Comments
CVE-2023-22833

Mandatory control bypass in Lime2

Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circumstances.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry
CVE-2023-30963

Stored XSS in Foundry Slate Query Dropdown menu

A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further intervention is required.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Frontend
CVE-2023-30960

Insecure Direct Object Reference (IDOR) in Foundry job-tracker

A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Job-tracker
CVE-2023-30956

IDOR in Foundry Comments allows retrieval of attachments

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Comments
CVE-2023-30955

Foundry workspace-server Developer Mode Authorization Bypass

A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mode settings in a limited capacity. A fix was deployed with workspace-server 7.7.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Workspace-server
CVE-2023-30952

Foundry Issues reporterPath phishing by parameter injection

A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 .

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry
CVE-2023-30950

CVE-2023-30950

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Campaigns
CVE-2023-30946

Issues notification metadata lacks authorization

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Issues
CVE-2023-22835

Denial of Service in Foundry Issues

A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants. This defect was resolved with the release of Foundry Issues 2.510.0 and Foundry Frontend 6.228.0.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Frontend Foundry Issues
CVE-2022-27889

The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.

The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Multipass
CVE-2022-27888

The Foundry Issues service was found to be logging in a manner that captured session tokens.

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Foundry Issues