Apache Pinot MCP Unauthenticated Remote Cluster Takeover - ATR-2026-00533 (3e513f35-d224-568f-a6ab-c76d4ac848f2)
Detects unauthenticated access to Apache Pinot MCP server cluster management endpoints. Apache Pinot MCP exposes cluster administration operations (schema modification, table deletion, segment management) without requiring authentication, allowing any network-reachable caller to take over the cluster via MCP tool calls. Detection covers (a) MCP configs pointing at Pinot endpoints without auth, (b) tool calls invoking Pinot cluster management functions without auth context, (c) content describing the unauthenticated surface. CWE-306 (Missing Authentication for Critical Function).