CWEweakness
CWE-183 Permissive List of Allowed Inputs
- Alternate terms
- Allowlist / Allow List, Safelist / Safe List, Whitelist / White List
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Common consequences
• Access Control: Bypass Protection Mechanism
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2019-12799: Chain: bypass of untrusted deserialization issue (CWE-502) by using an assumed-trusted class (CWE-183)
• CVE-2019-10458: CI/CD pipeline feature has unsafe elements in allowlist, allowing bypass of script restrictions
• CVE-2017-1000095: Default allowlist includes unsafe methods, allowing bypass of sandbox
Related
Attack pattern · CAPEC (4)
Observed example · CVE (3)
- CVE-2019-10458 Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers… vulnerability
- CVE-2019-12799 In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability,… vulnerability
- CVE-2017-1000095 The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object);… vulnerability
Can precede · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
Child of · CWE (1)
- CWE-697 Incorrect Comparison weakness
Referenced by CAPEC · weakness (4)
Referenced by CVE · weakness (57)
- CVE-2026-117570 Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that… vulnerability
- CVE-2026-115915 vLLM is an inference and serving engine for large language models. vulnerability
- CVE-2026-116339 A vulnerability was determined in iFlytek astron-agent up to 1.1.2. vulnerability
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. vulnerability
- CVE-2026-89106 SAP UI5 does not perform sufficient input validation under certain configurations. vulnerability
- CVE-2026-96229 Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network. vulnerability
- CVE-2026-106510 Backstage is an open framework for building developer portals. vulnerability
- CVE-2026-103687 A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. vulnerability
- CVE-2026-12974 A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). vulnerability
- CVE-2026-90808 A vulnerability was determined in HKUDS nanobot up to 0.2.1. vulnerability
- CVE-2026-54694 SkillTree is a micro-learning gamification platform. vulnerability
- CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. vulnerability
- CVE-2026-63649 The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the… vulnerability
- CVE-2026-67315 axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js,… vulnerability
- CVE-2026-67345 MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in… vulnerability
- CVE-2026-66005 Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows… vulnerability
- CVE-2026-16129 A vulnerability has been found in princezuda SafestClaw up to 4.2.4. vulnerability
- CVE-2026-46341 The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on… vulnerability
- CVE-2026-15625 A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. vulnerability
- CVE-2026-59802 PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. vulnerability
- CVE-2026-46608 Glances is an open-source system cross-platform monitoring tool. vulnerability
- CVE-2026-50189 Appsmith is a platform to build admin panels, internal tools, and dashboards. vulnerability
- CVE-2026-54316 Claude Code is an agentic coding tool. vulnerability
- CVE-2026-8918 A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or… vulnerability
- CVE-2026-11525 Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring,… vulnerability
- CVE-2026-3490 picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous… vulnerability
- CVE-2026-46391 HAX CMS helps manage microsite universe with PHP or NodeJs backends. vulnerability
- CVE-2026-44111 OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read… vulnerability
- CVE-2026-43574 OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists… vulnerability
- CVE-2026-29514 NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params()… vulnerability
Referenced by CWE · can also be (1)
- CWE-186 Overly Restrictive Regular Expression weakness
Referenced by CWE · child of (1)
- CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness