CVE-2023-30954: Gotham Video Broken Authentication

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-15 · updated 2026-06-17
Weakness: CWE-285

Description

The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized.

Affected products

Palantir com.palantir.video:video-application-server: before 2.206.1 — fixed in 2.206.1

How to fix

Upgrade to a fixed version: Palantir com.palantir.video:video-application-server 2.206.1. Check the vendor advisory for mitigations.

References

https://palantir.safebase.us/?tcuUid=d2366a3e-a92c-476e-8a7a-7db60e4be567
https://palantir.safebase.us/?tcuUid=d2366a3e-a92c-476e-8a7a-7db60e4be567

Get alerted when CVE-2023-30954 or the next vulnerability affects your stack