CVE-2024-24759: MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-09-05 · updated 2026-06-17
Weakness: CWE-918

Description

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.

Affected products

mindsdb: before 23.12.4.2 — fixed in 23.12.4.2

How to fix

Upgrade to a fixed version: mindsdb 23.12.4.2. Check the vendor advisory for mitigations.

References

https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b
https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr

Get alerted when CVE-2024-24759 or the next vulnerability affects your stack