---
id: CVE-2024-10306
title: A vulnerability was found in mod_proxy_cluster
summary: >-
  A vulnerability was found in mod_proxy_cluster. The issue is that the
  <Directory> directive should be replaced by the <Location> directive as the
  former does not restrict IP/host access as `Require ip IP_ADDRESS` would
  suggest. This mean…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-863
published: '2025-04-23'
updated: '2026-06-26'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-10306'
references:
  - url: 'https://access.redhat.com/errata/RHBA-2025:2973'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHBA-2025:5309'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9434'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9466'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:9997'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-10306'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2321302'
    label: secalert@redhat.com
  - url: 'https://github.com/modcluster/mod_proxy_cluster/pull/309'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00328
epssPercentile: 0.23219
ingestedAt: '2026-06-26T16:43:13.601Z'
---

## Overview

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.