A critical access control bypass in Palantir Foundry allows unauthorized cross-pod communication and potential command execution, necessitating immediate updates.

The vulnerability stems from improper resource compartmentalization (CWE-653), where a misconfiguration permits inter-pod communication within the same namespace. This flaw enables authenticated users with low privileges to leverage a vulnerable endpoint to execute arbitrary commands locally.

The ability to bypass access controls and execute commands across pod boundaries poses a severe risk to data confidentiality, integrity, and system availability. Given the CVSS score of 7.5, this high-severity vulnerability could allow an attacker to pivot between services, potentially compromising sensitive proprietary data or disrupting critical business operations hosted within the Foundry environment.

Immediate Action: Update com.palantir.compute:compute-service to version 0.1372.0 or later and com.palantir.codeassist2:code-assist-proxy to version 2.1289.0 or later.

Proactive Monitoring: Review container logs for unauthorized inter-pod traffic or unexpected command execution patterns originating from within the namespace.

Compensating Controls: Implement strict network policies within the Kubernetes or container orchestration environment to enforce isolation between pods, even if the application layer is misconfigured.

Public Exploit Available: Unknown

Organizations utilizing Palantir Foundry must prioritize the immediate deployment of the specified patches to remediate this access control flaw. Failure to address this vulnerability increases the risk of lateral movement and unauthorized command execution within the container environment, which could have cascading impacts on the integrity of the entire deployment.