CWEweakness
CWE-1327 Binding to an Unrestricted IP Address
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Other
- CWE version
- 5.0
Description
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
Common consequences
• Access Control: Bypass Protection Mechanism — Binding to the address 0.0.0.0 might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.
• Availability: DoS: Amplification
Potential mitigations
• [System Configuration] Assign IP addresses that are not 0.0.0.0.
• [System Configuration] Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.
Observed examples
• CVE-2023-41742: cybersecurity product binds to an unrestricted IP address
• CVE-2022-21947: Desktop manager for Kubernetes and container management binds a service to 0.0.0.0, allowing users on the network to make requests to a dashboard API.
Related
Attack pattern · CAPEC (1)
- CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs attack pattern
Observed example · CVE (2)
- CVE-2023-41742 Excessive attack surface due to binding to an unrestricted IP address. vulnerability
- CVE-2022-21947 A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the… vulnerability
Child of · CWE (1)
- CWE-923 Improper Restriction of Communication Channel to Intended Endpoints weakness
Referenced by CAPEC · weakness (1)
- CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs attack pattern
Referenced by CVE · weakness (32)
- CVE-2026-59177 ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. vulnerability
- CVE-2026-112346 OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and… vulnerability
- CVE-2026-92559 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an… vulnerability
- CVE-2026-108760 LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345,… vulnerability
- CVE-2026-100868 Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. vulnerability
- CVE-2026-57123 PraisonAI is a multi-agent teams system. vulnerability
- CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds… vulnerability
- CVE-2026-20212 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to… vulnerability
- CVE-2026-82456 argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when… vulnerability
- CVE-2026-72924 GitHub CLI (gh) is GitHub's official command line tool. vulnerability
- CVE-2026-16713 IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a… vulnerability
- CVE-2026-16503 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with… vulnerability
- CVE-2026-47873 The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0)… vulnerability
- CVE-2026-55641 9Router is an AI router & token saver. vulnerability
- CVE-2026-0481 Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized… vulnerability
- CVE-2026-42503 gopls by default communicates via pipe. vulnerability
- CVE-2026-24015 A vulnerability in Apache IoTDB. vulnerability
- CVE-2026-28395 OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be… vulnerability
- CVE-2026-21528 Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. vulnerability
- CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java… vulnerability
- CVE-2025-61934 A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. vulnerability
- CVE-2025-55322 Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network. vulnerability
- CVE-2025-3621 Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. vulnerability
- CVE-2024-49382 Excessive attack surface in archive-server service due to binding to an unrestricted IP address. vulnerability
- CVE-2024-49383 Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. vulnerability
- CVE-2024-49384 Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. vulnerability
- CVE-2024-47176 CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not… vulnerability
- CVE-2024-36105 dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. vulnerability
- CVE-2023-5398 Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. vulnerability
- CVE-2023-41742 Excessive attack surface due to binding to an unrestricted IP address. vulnerability