CVE-2022-27891

Name of the Vulnerable Software and Affected Versions Palantir Gotham versions prior to 103.30221005.0

Description The issue concerns an unauthenticated endpoint in Palantir Gotham that lists all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances.

Recommendations For Palantir Gotham versions prior to 103.30221005.0, it is highly recommended that customers upgrade all affected services to the latest version. As a temporary workaround, consider restricting access to the unauthenticated endpoint until the issue is resolved.