CWE-1327
AllowedBinding to an Unrestricted IP Address
Abstraction: Base · Status: Incomplete
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
44 vulnerabilities reference this CWE, most recent first.
GHSA-92G9-C25J-HQP6
Vulnerability from github – Published: 2023-08-31 15:30 – Updated: 2023-08-31 15:30Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
{
"affected": [],
"aliases": [
"CVE-2023-41742"
],
"database_specific": {
"cwe_ids": [
"CWE-1327",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-31T15:15:08Z",
"severity": "MODERATE"
},
"details": "Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.",
"id": "GHSA-92g9-c25j-hqp6",
"modified": "2023-08-31T15:30:17Z",
"published": "2023-08-31T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41742"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-4351"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9344-F92H-VR44
Vulnerability from github – Published: 2026-05-06 18:30 – Updated: 2026-05-06 18:30gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
{
"affected": [],
"aliases": [
"CVE-2026-42503"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T17:16:23Z",
"severity": "HIGH"
},
"details": "gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.\u00a0\nAs a result, users might\u00a0inadvertently cause gopls to bind 0.0.0.0.\nThis can allow a\u00a0malicious party on the same network to execute code arbitrarily via gopls.",
"id": "GHSA-9344-f92h-vr44",
"modified": "2026-05-06T18:30:31Z",
"published": "2026-05-06T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42503"
},
{
"type": "WEB",
"url": "https://go.dev/cl/774381"
},
{
"type": "WEB",
"url": "https://go.dev/issue/79211"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPWH-2GHX-4JVR
Vulnerability from github – Published: 2023-04-28 21:30 – Updated: 2024-04-04 03:43Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.
{
"affected": [],
"aliases": [
"CVE-2023-1968"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-28T19:15:16Z",
"severity": "HIGH"
},
"details": "\nInstruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. \n\n\n\n\n\n\n\n",
"id": "GHSA-cpwh-2ghx-4jvr",
"modified": "2024-04-04T03:43:59Z",
"published": "2023-04-28T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1968"
},
{
"type": "WEB",
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHFP-X6GX-HFQM
Vulnerability from github – Published: 2025-09-24 21:30 – Updated: 2025-09-24 21:30Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.
{
"affected": [],
"aliases": [
"CVE-2025-55322"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-24T19:15:38Z",
"severity": "HIGH"
},
"details": "Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.",
"id": "GHSA-fhfp-x6gx-hfqm",
"modified": "2025-09-24T21:30:37Z",
"published": "2025-09-24T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55322"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55322"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-G3WF-C9JP-7296
Vulnerability from github – Published: 2024-10-15 12:30 – Updated: 2024-10-15 12:30Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
{
"affected": [],
"aliases": [
"CVE-2024-49382"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-15T11:15:13Z",
"severity": "LOW"
},
"details": "Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.",
"id": "GHSA-g3wf-c9jp-7296",
"modified": "2024-10-15T12:30:37Z",
"published": "2024-10-15T12:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49382"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-7286"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G7C7-634V-GP3R
Vulnerability from github – Published: 2026-05-15 06:30 – Updated: 2026-05-15 06:30Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability
{
"affected": [],
"aliases": [
"CVE-2026-0481"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-15T05:16:33Z",
"severity": "CRITICAL"
},
"details": "Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability",
"id": "GHSA-g7c7-634v-gp3r",
"modified": "2026-05-15T06:30:29Z",
"published": "2026-05-15T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0481"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6031.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J4VQ-Q93M-4683
Vulnerability from github – Published: 2025-12-02 00:35 – Updated: 2025-12-02 00:35A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
Red Hat evaluates this as a Moderate impact vulnerability due to the requirement of running debug mode and untrusted network. Also, for Red Hat Single Sign-On, this must as well be bound to 0.0.0.0 address, which is not recommended in production scenarios.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-quarkus-dist"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-11538"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-02T00:35:03Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A vulnerability exists in Keycloak\u0027s server distribution where enabling debug mode (`--debug`) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (`0.0.0.0`). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.\n\nRed Hat evaluates this as a Moderate impact vulnerability due to the requirement of running debug mode and untrusted network. Also, for Red Hat Single Sign-On, this must as well be bound to 0.0.0.0 address, which is not recommended in production scenarios.",
"id": "GHSA-j4vq-q93m-4683",
"modified": "2025-12-02T00:35:03Z",
"published": "2025-12-02T00:35:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-j4vq-q93m-4683"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11538"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21370"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21371"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-11538"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402622"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak has debug default bind address"
}
GHSA-MFW9-VJXF-GVR8
Vulnerability from github – Published: 2026-02-10 18:30 – Updated: 2026-02-10 18:30Binding to an unrestricted ip address in Azure IoT SDK allows an unauthorized attacker to disclose information over a network.
{
"affected": [],
"aliases": [
"CVE-2026-21528"
],
"database_specific": {
"cwe_ids": [
"CWE-1327",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T18:16:35Z",
"severity": "MODERATE"
},
"details": "Binding to an unrestricted ip address in Azure IoT SDK allows an unauthorized attacker to disclose information over a network.",
"id": "GHSA-mfw9-vjxf-gvr8",
"modified": "2026-02-10T18:30:42Z",
"published": "2026-02-10T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21528"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21528"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P2X5-X87W-V2XJ
Vulnerability from github – Published: 2026-08-29 15:30 – Updated: 2026-08-29 15:30argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
{
"affected": [],
"aliases": [
"CVE-2026-82456"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-29T14:16:38Z",
"severity": "CRITICAL"
},
"details": "argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator\u0027s stored token to create applications, request syncs, and modify Argo CD resources.",
"id": "GHSA-p2x5-x87w-v2xj",
"modified": "2026-08-29T15:30:21Z",
"published": "2026-08-29T15:30:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82456"
},
{
"type": "WEB",
"url": "https://github.com/argoproj-labs/mcp-for-argocd"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/argocd-mcp-0.8.0-authentication-bypass-via-unauthenticated-http"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PH62-G3GP-MMVR
Vulnerability from github – Published: 2026-07-30 06:32 – Updated: 2026-07-30 06:32The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
{
"affected": [],
"aliases": [
"CVE-2026-47873"
],
"database_specific": {
"cwe_ids": [
"CWE-1327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T06:25:52Z",
"severity": "HIGH"
},
"details": "The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host\u0027s network interfaces (0.0.0.0) rather than restricting them to loopback.\nAffected Spring Products and Versions:\nSpring Tools for Eclipse: 5.2.0 and earlier",
"id": "GHSA-ph62-g3gp-mmvr",
"modified": "2026-07-30T06:32:37Z",
"published": "2026-07-30T06:32:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47873"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-47873"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Assign IP addresses that are not 0.0.0.0.
Mitigation
Strategy: Firewall
Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.