PT-2026-4275 · Palantir · Aries Service+1

Published 2026-01-22 · Updated 2026-01-23 · CVE-2025-68609

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palantir Apollo Aries Service (affected versions not specified)

Description A flaw exists in Palantir's Aries service that permitted unauthenticated access to log viewing and management features on Apollo instances when using the default configuration. This bypasses authentication and authorization checks, potentially enabling any network-accessible client to view system logs and perform operations without proper credentials. There is no indication that this issue was exploited. The affected functionality involves accessing logs and managing them.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2025-68609

Affected Products

Aries Service

Palantir Apollo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-68609 · Security Note
• https://palantir.safebase.us/?tcuUid=955a313a-1735-48a6-9fb4-e10404f14eb5 · Note
• https://twitter.com/CVEnew/status/2014706942795493799 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014432931926724839 · Twitter Post