CVE-2022-27889: The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-14 · updated 2026-06-17
Weakness: CWE-400

Description

The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.

Affected products

Palantir Foundry Multipass: before 3.647.0 — fixed in 3.647.0

How to fix

Upgrade to a fixed version: Palantir Foundry Multipass 3.647.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-27889 or the next vulnerability affects your stack