Trust and Security Portal
Palantir is a software company that builds the world's leading software for data-driven operations and decision-making. For more than a decade, we’ve worked with customers in the most secure and highly-regulated industries and built software for their most sensitive data. Today, security remains the cornerstone of our product development, company culture, and internal operations.
Palantir cares deeply about the security outcomes of our customers, and we’re committed to transparency about our security practices and program. We stand resolute in continuously improving our security, data protection, and privacy controls to give you the most effective means of protecting your data possible.
Trust and Security Portal Updates
CVE-2026-98432
Palantir's response to CVE-2026-98432
November 5, 2026
Summary:
CVE-2026-98432 is a use-after-free race condition in the Linux kernel's IPv4 TCP handshake path. A remote, unauthenticated attacker could send crafted IPv4 TCP packets containing IP options to an affected system, potentially causing a kernel crash and denial of service.
Palantir has reviewed fleet inventory, infrastructure configuration, and ingress paths. Existing infrastructure-level controls mitigate direct exposure across the deployment paths reviewed, and Palantir has not confirmed an Internet-exploitable deployment. Validation of remaining direct-access and TCP-pass-through paths is ongoing.
Available vendor patches and additional network mitigations are being deployed across affected systems. Investigation of Palantir's production environments and internal systems is ongoing and has so far found no indications of abuse.
Details:
The vulnerability occurs when memory associated with IPv4 TCP connection handling is freed while another CPU is still using it. The published vulnerability information identifies kernel crash and denial of service as the impact. Direct data disclosure or reliable code execution has not been established.
Palantir is continuing to validate remaining exposure paths and deploy vendor patches as they become available.
Customers are strongly advised to review and apply vendor-supplied kernel updates to affected customer-managed Linux systems.
See the CVE record:
https://www.cve.org/CVERecord?id=CVE-2026-98432
See the AWS Security Bulletin:
https://aws.amazon.com/security/security-bulletins/2026-160-aws/
eMudhra Intermediate CA Private Key Issue
eMudhra Intermediate CA Private Key Exposure
October 26, 2026
Palantir response to the eMudhra intermediate CA private key exposure
Summary:
Eight eMudhra intermediate certificate authority private keys were rendered recoverable by weak key generation. The affected intermediates chain to broadly trusted roots and could be used to intercept TLS traffic from any system that continues to trust them.
Palantir is treating removal of trust in the affected intermediates as a priority remediation. Updated trust stores have been deployed across endpoints, production, and internal services.
Investigation of internal systems and Palantir production environments has found no indications of abuse.
Details:
Palantir has been tracking the disclosure that eight eMudhra intermediates were issued with keys generated by a flawed process, leaving the corresponding private keys recoverable. An attacker holding a recovered key can issue certificates that systems accept as valid, enabling machine-in-the-middle (MitM) interception. Palantir reproduced the technique against a production environment to confirm impact and validate remediation.
The updated Palantir CA bundle and associated change are complete .
Investigation of Palantir's production environments and internal systems has found no indications of abuse.
Customers are strongly advised to remove trust in the affected eMudhra intermediates from customer-managed systems, including language and runtime trust stores.
See eMudhra official statement : https://emudhra.com/en/post/certificate-security-incident
Node.js CVE-2026-111497
Palantir response to Node.js CVE-2026-111497 (Node2Shell)
Summary:
Node.js is used across internal systems and Palantir products. Node.js rates the vulnerability High, Palantir is treating remediation as an emergency priority to ensure patching is completed as soon as possible.
Node.js patched versions have been rolled out and applied across Palantir production and internal services. Investigation of internal systems and Palantir production environments has found no indications of abuse.
Details:
Palantir has been tracking the public release of exploit code (Node2Shell) targeting a Node.js vulnerability that allows remote code execution (RCE) and poses a major risk to all unpatched Node.js installations. This is a dependency vulnerability from the Brotli decoder bundled with Node.js. The decoder can be tricked into writing data past the end of a memory buffer, which is a route to crashes and potentially code execution.
Node.js has released the patched versions of 22.23.4, 24.22.1, and 26.12.1, alongside nine other vulnerabilities. Other products that bundle vulnerable Brotli code need their own vendor assessment and update. Brotli has patched this vulnerability in 1.2.1 with backports to 1.1.1 & 1.0.10.
Customers are strongly advised to review and patch affected customer-managed systems, customer-developed integrations, and customer integrated code in their enrollment of the Palantir Platform. Node.js patched versions are available in all customer-facing artifact registries, and customer container security posture is available in the Container Governance [https://www.palantir.com/docs/foundry/administration/container-governance] application. A set of upgrade assistant campaigns have been launched in-platform to help customers track their own impact; customers are strongly advised to action upgrade assistant campaigns in their environment.
See the Node.js Security Release: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
PHP CVE-2026-109618 and CVE-2026-109619
Palantir response to PHP CVE-2026-109618 and CVE-2026-109619 (PHP2shell)
Summary:
Palantir's actively supported products and managed production infrastructure are not affected by PHP2shell (CVE-2026-109618 and CVE-2026-109619). PHP is not utilized in our products.
Proactive mitigations and applicable patches have been deployed across production and internal services. Investigation of internal systems and Palantir production environments has found no indications of abuse.
Details:
Palantir has been tracking the public release of exploit code (PHP2shell) targeting the two PHP vulnerabilities that allow unauthenticated remote code execution (RCE) and pose a critical risk to all PHP installations serving web requests. PHP has released the patched versions of 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
After a comprehensive review, Palantir has confirmed that there are no vulnerable PHP versions in our actively supported products. Palantir has no reliance on and has found no evidence of the impacted PHP versions in our managed/hosted production infrastructure.
A vulnerable dependency in a deprecated service deployed in a small number of air-gapped environments was promptly patched.
Customers are strongly advised to review and patch affected customer-managed systems. See the PHP Security Advisory: https://www.php.net/index.php
Axios Breach Bulletin
We have conducted a thorough investigation and validated that we are not impacted by the Axios breach. The malicious Axios package was never published to any Palantir production environments.