Log in Start free

Vulnerability · Published Jan 22, 2026 · Assigned by Palantir

CVE-2025-68609Authentication bypass in Aries due to misconfiguration

Medium 6.6

In plain English

A medium-severity security flaw in com.palantir.aries:aries from Palantir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible client to view system logs and perform operations without valid credentials. No evidence of exploitation was identified during the vulnerability window.

Affected products (as reported)

VendorProductVersions
Palantir com.palantir.aries:aries see references

Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References