GHSA-hxvr-gg2w-j48x

HIGH8.0

BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Published Jun 9, 2025

Modified 9 months ago

Details

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.

NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from https://github.com/lablup/backend.ai/pull/7587 in their instances to protect themselves from the conditions that would lead to the situation described in the CVE record.

Affected Packages

backend.ai

PyPI

References

ADVISORY

https://github.com/advisories/GHSA-hxvr-gg2w-j48x

PACKAGE

https://github.com/lablup/backend.ai

WEB

https://github.com/lablup/backend.ai/pull/7587

WEB

https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653