CVE-2024-31455

Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit `5c381cf` added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to `5c381cf`, or roll forward past `2eb94e7`.

• CWE-200

• https://github.com/stacklok/minder/commit/11b6573ad62cfdd783a8bb52f3fce461466037f4
• https://github.com/stacklok/minder/commit/5c381cfbf3e4b7ce040ed8511a1fae1a78a0014b
• https://github.com/stacklok/minder/pull/2941
• https://github.com/stacklok/minder/security/advisories/GHSA-ggp5-28x4-xcj9
• https://github.com/stacklok/minder/commit/11b6573ad62cfdd783a8bb52f3fce461466037f4
• https://github.com/stacklok/minder/commit/5c381cfbf3e4b7ce040ed8511a1fae1a78a0014b
• https://github.com/stacklok/minder/pull/2941
• https://github.com/stacklok/minder/security/advisories/GHSA-ggp5-28x4-xcj9

Published

Apr 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3145A vulnerability was found in DedeCMS 5.7. It has been rated …4.3
• CVE-2024-31450Owncast is an open source, self-hosted, decentralized, singl…6.5
• CVE-2024-31451DocsGPT is a GPT-powered chat for documentation. DocsGPT is …5.3
• CVE-2024-31452OpenFGA is a high-performance and flexible authorization/per…9.8
• CVE-2024-31453PsiTransfer is an open source, self-hosted file sharing solu…6.5
• CVE-2024-31454PsiTransfer is an open source, self-hosted file sharing solu…6.5
• CVE-2024-31456GLPI is a Free Asset and IT Management Software package. Pri…6.5
• CVE-2024-31457gin-vue-admin is a backstage management system based on vue …7.7
• CVE-2024-31458Cacti provides an operational monitoring and fault managemen…8
• CVE-2024-31459Cacti provides an operational monitoring and fault managemen…7.2
• CVE-2024-3146A vulnerability classified as problematic has been found in …4.3
• CVE-2024-31460Cacti provides an operational monitoring and fault managemen…8.8