TI-2024-20819 Aliases CVE-2024-31455 GHSA-ggp5-28x4-xcj9

Minder GetRepositoryByName data leak

LOW 21CWE-200Published 2024-04-09 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit `5c381cf` added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to `5c381cf`, or roll forward past `2eb94e7`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00765 55th percentileScored 2026-11-07

Fix Fixed github.com/stacklok/minder (Go): 0.0.40

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
stacklok	minder	= 0.0.39	—	No fix listed	CNA
—	github.com/stacklok/minder (Go)	0.0.39 to before 0.0.40	0.0.40	Patch available	GHSA-ggp5-28x4-xcj9

minder Vendorstacklok Affected = 0.0.39 Fixed in — No fix listed CNA
github.com/stacklok/minder (Go) Vendor— Affected 0.0.39 to before 0.0.40 Fixed in 0.0.40 Patch available GHSA-ggp5-28x4-xcj9

Remediation

Fix · GHSA-ggp5-28x4-xcj9 github.com/stacklok/minder (Go) Fixed in 0.0.40 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-31455
2026-10-03 Alias added: GHSA-ggp5-28x4-xcj9

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-31455

Other 5

TI-2026-41912 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement CVSS 3.1HIGH 8.8
TI-2024-22541 Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests CVSS 3.1HIGH 7.5
TI-2026-41911 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) CVSS 3.1MEDIUM 4.7
TI-2024-25220 Denial of service from maliciously configured Git repository in Minder CVSS 3.1MEDIUM 5.7
TI-2024-23307 Denial of service of Minder Server from maliciously crafted GitHub attestations CVSS 3.1MEDIUM 5.3
TI-2024-23266 Stacklok Minder vulnerable to denial of service from maliciously crafted templates CVSS 3.1MEDIUM 5.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences