AIKIDO-2026-69146
mockttp is vulnerable to Binding to an Unrestricted IP Address
75
CVE Score
High
Binding to an Unrestricted IP Address
TL;DR
The optional remote admin server binds to all network interfaces (0.0.0.0) by default when it is started without an explicit host, or with only a port. Any party with network access to the admin port can then configure and start mock servers with custom rules without authentication. This can be abused to read process-readable files from the host machine and retrieve them through a dynamically created mock server. The fix changes the default bind host to 127.0.0.1 so the admin API only accepts local connections unless explicitly configured otherwise.
How do I fix this?
Upgrade the mockttp library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable the remote admin server with default or port-only settings so it binds to all network interfaces and is reachable by untrusted parties.
Package
Versions
0.0.1 - 3.17.1
Fixed in 3.17.24.0.0 - 4.5.0
Fixed in 4.6.0Background info
mockttp is vulnerable to Binding to an Unrestricted IP Address in versions 0.0.1 - 3.17.1 and 4.0.0 - 4.5.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.