PT-2025-52487 · Apollo · Glutton V1

Published 2025-12-19 · Updated 2026-04-19 · CVE-2024-49587

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Glutton V1 (affected versions not specified)

Description The Glutton V1 service had exposed endpoints on Gotham stacks without authentication. This allowed users without proper permissions to directly access the Glutton backend, potentially enabling them to read, update, or delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances. The issue grants full read/write capabilities to the backend.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2024-49587

Affected Products

Glutton V1

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-49587 · Security Note
• https://twitter.com/Weidenfeild/status/2045874585757728963 · Twitter Post
• https://t.me/CVEtracker/40283 · Telegram Post
• https://twitter.com/CveFindCom/status/2002071264500793481 · Twitter Post
• https://twitter.com/CVEnew/status/2002099139946184752 · Twitter Post
• https://twitter.com/0dayPublishing/status/2002056467411607587 · Twitter Post
• https://t.me/cveNotify/146360 · Telegram Post
• https://palantir.safebase.us/?tcuUid=95e2d805-dd2f-4544-b164-e61100f47b11 · Note
• https://twitter.com/TheHackerWire/status/2002066155343937682 · Twitter Post