CVE-2024-24759: MindsDB is a platform for building artificial intelligence from enterprise data

This week

CRITICAL 9.3REMOTEUPGRADE

CVE-2024-24759 is a critical-severity flaw (CVSS 9.3) affecting mindsdb. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.

Why this priority

Critical severity
EPSS top 8%: very likely to be exploited
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.3 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	4.9% (top 8%)
CISA exploited list	No
Weakness	CWE-918
Published	2024-09-05
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: mindsdb

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-09-05 17:15 UTCPublished CVE record published
2026-06-17 07:14 UTCUpdated Record last modified

mindsdb mindsdb UPGRADE

Affected: < 23.12.4.2

Fixed in: 23.12.4.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy mindsdb || rpm -q mindsdb || mindsdb --version

2. UPGRADE to 23.12.4.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade mindsdb

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade mindsdb

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Python (pip) · mindsdb · FIXED · 23.12.4.2 · vulnerable: < 23.12.4.2 · source

pip install --upgrade "mindsdb>=23.12.4.2" pip show mindsdb

Fedora 46 · noctalia · FIXED · 5.4.1-1.fc46 · FEDORA-2026-a4755e8ef7 · source

sudo dnf upgrade --advisory=FEDORA-2026-a4755e8ef7

Fedora ELN · efifs · FIXED · 1.13-1.eln159 · FEDORA-2026-3fd0bb7307 · source

sudo dnf upgrade --advisory=FEDORA-2026-3fd0bb7307

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr
Nuclei scan template: MindsDB -DNS Rebinding SSRF Protection Bypass

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-24759?

mindsdb: upgrade to 23.12.4.2. Exact commands for each OS are on this page.

Is CVE-2024-24759 being exploited?

CVE-2024-24759 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-24759 affect?

CVE-2024-24759 affects mindsdb. Severity is critical (CVSS 9.3). MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can

How urgent is CVE-2024-24759?

Priority 66/100. Critical severity; EPSS top 8%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-2531 MEDIUM 6.3 UPGRADE A security vulnerability has been detected in MindsDB up to 25.14.1
CVE-2026-27483 HIGH 8.8 UPGRADE MindsDB is a platform for building artificial intelligence from enterprise data
CVE-2025-68472 HIGH 8.1 UPGRADE MindsDB is a platform for building artificial intelligence from enterprise data
CVE-2024-3575 MEDIUM 6.1 DOWNGRADE Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb

References

← Back to latest CVEs