CWE-1327 Binding to an Unrestricted IP Address
baseThe product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (33)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-20212US | critical9.8 | Exploit | ||
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges.
Th… | ||||
| CVE-2026-82456US | critical10.0 | — | ||
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers wh… | ||||
| CVE-2026-112346US | critical9.8 | — | ||
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sand… | ||||
| CVE-2026-92559US | critical9.8 | — | ||
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. | ||||
| CVE-2026-24015US | critical9.8 | — | ||
A vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.7 or 2.0.7, wh… | ||||
| CVE-2026-28395US | critical9.1 | — | ||
OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server that treats… | ||||
| CVE-2023-1968US | high7.5 | — | ||
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on al… | ||||
| CVE-2026-108760US | high7.6 | — | ||
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST… | ||||
| CVE-2023-41742US | high7.5 | — | ||
Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber… | ||||
| CVE-2024-47176US | — | Exploit | ||
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services an… | ||||
| CVE-2026-100868US | medium6.3 | — | ||
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networ… | ||||
| CVE-2026-16713US | medium5.3 | — | ||
IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documenta… | ||||
| CVE-2024-49384US | medium4.3 | — | ||
Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befo… | ||||
| CVE-2024-49383US | medium4.3 | — | ||
Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… | ||||
| CVE-2024-49382US | medium4.3 | — | ||
Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befo… | ||||
| CVE-2022-29820US | low3.5 | — | ||
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible | ||||
| CVE-2026-57123US | —OT elevated | — | ||
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes w… | ||||
| CVE-2026-75021US | — | — | ||
fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable addres… | ||||
| CVE-2026-72924US | — | — | ||
GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interf… | ||||
| CVE-2026-16503US | —OT elevated | — | ||
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "post… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan