CVE-2025-65109 Minder does not sandbox http.send in Rego programs
Attackers can exploit unsandboxed HTTP requests in Rego programs to access internal resources via the Minder server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65109?
CVE-2025-65109 is a high-severity server-side request forgery vulnerability in mindersec minder, published on 21 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.
Weakness: CWE-830
Which versions are affected by CVE-2025-65109?
3 open source packages ship an affected version, including github.com/mindersec/minder.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mindersec/minder Go | From 0.0.72 | 0.0.84 |
github.com/mindersec/minder Go | From 0.0.72 | 0.0.84 |
github.com/mindersec/minder Go | From 0.0.72 | 0.0.84 |
How do I fix CVE-2025-65109?
Upgrade github.com/mindersec/minder to 0.0.84 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-65109 being exploited?
There is no known exploitation of CVE-2025-65109 in the wild and no public exploit code.
Sources
Also known as GHSA-6xvf-4vh9-mw47, GO-2025-4147.