{"cve":"CVE-2024-36105","nvd":{"published":"2024-05-27T18:15:10.613","modified":"2026-06-17T07:36:06.907","status":"Deferred","description":"dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to `INADDR_ANY (0.0.0.0)` or `IN6ADDR_ANY (::)` exposes an application on all network interfaces, increasing the risk of unauthorized access. As stated in the Python docs, a special form for address is accepted instead of a host address: `''` represents `INADDR_ANY`, equivalent to `\"0.0.0.0\"`. On systems with IPv6, '' represents `IN6ADDR_ANY`, which is equivalent to `\"::\"`. A user who serves docs on an unsecured public network, may unknowingly be hosting an unsecured (http) web site for any remote user/system to access on the same network. The issue has has been mitigated in dbt-core v1.6.15, dbt-core v1.7.15, and dbt-core v1.8.1 by binding to localhost explicitly by default in `dbt docs serve`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-1327"],"references":["https://cwe.mitre.org/data/definitions/1327.html","https://docs.python.org/3/library/socket.html#socket-families","https://docs.securesauce.dev/rules/PY030","https://github.com/dbt-labs/dbt-core/blob/main/core/dbt/task/docs/serve.py#L23C38-L23C39","https://github.com/dbt-labs/dbt-core/commit/0c08d7a19ad1740be3cb0b2e6d9d64f6537176f7"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:50:30.954589733+00:00"},"epss":{"cve":"CVE-2024-36105","score":0.0071,"percentile":0.53543,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-pmrx-695r-4349","url":"https://osv.dev/vulnerability/GHSA-pmrx-695r-4349","summary":"dbt allows Binding to an Unrestricted IP Address via socketsocket","modified":"2026-09-10T03:49:18.769494383Z","packages":[{"ecosystem":"PyPI","name":"dbt-core","purl":"pkg:pypi/dbt-core","ranges":["<1.6.15"],"fixed":["1.6.15"]},{"ecosystem":"PyPI","name":"dbt-core","purl":"pkg:pypi/dbt-core","ranges":[">=1.7.0 <1.7.15"],"fixed":["1.7.15"]},{"ecosystem":"PyPI","name":"dbt-core","purl":"pkg:pypi/dbt-core","ranges":[">=1.8.0 <1.8.1"],"fixed":["1.8.1"]}]},{"id":"PYSEC-2026-1292","url":"https://osv.dev/vulnerability/PYSEC-2026-1292","summary":"dbt allows Binding to an Unrestricted IP Address via socketsocket","modified":"2026-07-07T17:46:33.764662534Z","packages":[{"ecosystem":"PyPI","name":"dbt-core","purl":"pkg:pypi/dbt-core","ranges":["<1.6.15",">=1.7.0 <1.7.15",">=1.8.0 <1.8.1"],"fixed":["1.6.15","1.7.15","1.8.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}