HIGH 8.0 PyPI

BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

GHSA-hxvr-gg2w-j48x · CVE-2025-49653

Published · Modified

Description

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.

NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from https://github.com/lablup/backend.ai/pull/7587 in their instances to protect themselves from the conditions that would lead to the situation described in the CVE record.

Ready to move

Start Securing

Free, no credit card | First findings in minutes