TI-2024-19655 Aliases CVE-2024-29887 GHSA-h6x7-r5rg-x5fw

Serverpod client accepts any certificate

HIGH 68CWE-295Published 2024-03-27 · Updated 2024-08-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00284 21st percentileScored 2026-11-07

Fix Fixed serverpod (serverpod): 1.2.6serverpod_client (Pub): 1.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
serverpod	serverpod	before 1.2.6	1.2.6	Patch available	CNA
—	serverpod_client (Pub)	before 1.2.6	1.2.6	Patch available	GHSA-h6x7-r5rg-x5fw

serverpod Vendorserverpod Affected before 1.2.6 Fixed in 1.2.6 Patch available CNA
serverpod_client (Pub) Vendor— Affected before 1.2.6 Fixed in 1.2.6 Patch available GHSA-h6x7-r5rg-x5fw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:serverpod:serverpod::::::::	before 1.2.6	Vulnerable	serverpod

cpe:2.3:a:serverpod:serverpod:*:*:*:*:*:*:*:* Versions before 1.2.6 Vulnerable ·serverpod

Remediation

Fix · CNA serverpod (serverpod) Fixed in 1.2.6
Fix · GHSA-h6x7-r5rg-x5fw serverpod_client (Pub) Fixed in 1.2.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-29887
2026-10-03 Alias added: GHSA-h6x7-r5rg-x5fw

References

Patch 1

https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71

Advisory 2

Other 1

https://github.com/serverpod/serverpod

TI-2024-19654 Improved security for stored password hashes CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences