CVE-2024-35585 Auth bypass in MinKNOW
Attackers can bypass authentication in MinKNOW by spoofing their source IP address, gaining unauthorized access to the sequencing control interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-35585?
CVE-2024-35585 is a high-severity authentication bypass vulnerability in Oxford Nanopore MinKNOW, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.
Weakness: CWE-306
Which versions are affected by CVE-2024-35585?
How do I fix CVE-2024-35585?
No fix has been published for CVE-2024-35585 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-35585 being exploited?
There is no known exploitation of CVE-2024-35585 in the wild and no public exploit code.
Sources
Also known as GHSA-46ch-vj4w-7pw8.