PT-2026-4275 · Palantir · Aries Service+1

Publicado 2026-01-22 · Atualizado 2026-01-23 · CVE-2025-68609

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palantir Apollo Aries Service (affected versions not specified)

Description A flaw exists in Palantir's Aries service that permitted unauthenticated access to log viewing and management features on Apollo instances when using the default configuration. This bypasses authentication and authorization checks, potentially enabling any network-accessible client to view system logs and perform operations without proper credentials. There is no indication that this issue was exploited. The affected functionality involves accessing logs and managing them.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-305

Identificadores relacionados

CVE-2025-68609

Produtos afetados

Aries Service

Palantir Apollo

Referências · 4

• https://palantir.safebase.us/?tcuUid=955a313a-1735-48a6-9fb4-e10404f14eb5 · Nota
• https://twitter.com/CVEnew/status/2014706942795493799 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-68609 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2014432931926724839 · Publicação no Twitter