CVE-2024-36105

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to `INADDR_ANY (0.0.0.0)` or `IN6ADDR_ANY (::)` exposes an application on all network interfaces, increasing the risk of unauthorized access. As stated in the Python docs, a special form for address is accepted instead of a host address: `''` represents `INADDR_ANY`, equivalent to `"0.0.0.0"`. On systems with IPv6, '' represents `IN6ADDR_ANY`, which is equivalent to `"::"`. A user who serves docs on an unsecured public network, may unknowingly be hosting an unsecured (http) web site for any remote user/system to access on the same network. The issue has has been mitigated in dbt-core v1.6.15, dbt-core v1.7.15, and dbt-core v1.8.1 by binding to localhost explicitly by default in `dbt docs serve`.

• CWE-1327

• https://cwe.mitre.org/data/definitions/1327.html
• https://docs.python.org/3/library/socket.html#socket-families
• https://docs.securesauce.dev/rules/PY030
• https://github.com/dbt-labs/dbt-core/blob/main/core/dbt/task/docs/serve.py#L23C38-L23C39
• https://github.com/dbt-labs/dbt-core/commit/0c08d7a19ad1740be3cb0b2e6d9d64f6537176f7
• https://github.com/dbt-labs/dbt-core/issues/10209
• https://github.com/dbt-labs/dbt-core/pull/10208
• https://github.com/dbt-labs/dbt-core/releases/tag/v1.6.15
• https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.15
• https://github.com/dbt-labs/dbt-core/releases/tag/v1.8.1
• https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-pmrx-695r-4349
• https://cwe.mitre.org/data/definitions/1327.html
• https://docs.python.org/3/library/socket.html#socket-families
• https://docs.securesauce.dev/rules/PY030
• https://github.com/dbt-labs/dbt-core/blob/main/core/dbt/task/docs/serve.py#L23C38-L23C39
• https://github.com/dbt-labs/dbt-core/commit/0c08d7a19ad1740be3cb0b2e6d9d64f6537176f7
• https://github.com/dbt-labs/dbt-core/issues/10209
• https://github.com/dbt-labs/dbt-core/pull/10208
• https://github.com/dbt-labs/dbt-core/releases/tag/v1.6.15
• https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.15
• https://github.com/dbt-labs/dbt-core/releases/tag/v1.8.1
• https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-pmrx-695r-4349

Published

May 27, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36081Westermo EDW-100 devices through 2024-05-03 allow an unauthe…9.8
• CVE-2024-36082SQL injection vulnerability in Music Store - WordPress eComm…6.5
• CVE-2024-3609The ReviewX – Multi-criteria Rating & Reviews for WooCommerc…4.3
• CVE-2024-3610The WP Child Theme Generator plugin for WordPress is vulnera…5.3
• CVE-2024-36103OS command injection vulnerability in WRC-X5400GS-B v1.0.10 …6.8
• CVE-2024-36104Improper Limitation of a Pathname to a Restricted Directory …9.1
• CVE-2024-36106Argo CD is a declarative, GitOps continuous delivery tool fo…4.3
• CVE-2024-36107MinIO is a High Performance Object Storage released under GN…5.3
• CVE-2024-36108casgate is an Open Source Identity and Access Management sys…9.8
• CVE-2024-36109CoCalc is web-based software that enables collaboration in r…7.6
• CVE-2024-3611The Toolbar Extras for Elementor & More – WordPress Admin Ba…6.4
• CVE-2024-36110ansibleguy-webui is an open source WebUI for using Ansible. …8.2