CWE-1327 Binding to an Unrestricted IP Address
Description
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1327 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-vv4j-m4vr-f3g6 | CVE-2026-59177 | HIGH |
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces |
2026-09-09 | |
| GHSA-86m2-fcxq-5q7c | CVE-2026-55641 | HIGH |
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF |
2026-08-28 | |
| GHSA-x227-pf99-vffg | CVE-2026-57123 | CRITICAL |
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in |
2026-07-20 | |
| GHSA-525j-hqq2-66r4 | - | HIGH |
OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 |
2026-04-17 | |
| GHSA-74cf-pgh9-m5q2 | CVE-2026-24015 | CRITICAL |
Apache IoTDB has an Insecure Default Configuration Vulnerability |
2026-03-11 | |
| GHSA-qw99-grcx-4pvm | CVE-2026-28395 | MODERATE |
OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback |
2026-03-06 | |
| GHSA-7m9g-pmxf-m9m8 | - | MODERATE |
Duplicate Advisory: Keycloak allows Binding to an Unrestricted IP Address |
2025-12-20 | |
| GHSA-j4vq-q93m-4683 | CVE-2025-11538 | MODERATE |
Keycloak has debug default bind address |
2025-12-02 | |
| GHSA-pmrx-695r-4349 | CVE-2024-36105 | MODERATE |
dbt allows Binding to an Unrestricted IP Address via socketsocket |
2024-05-28 |