dbcve.org
CWE-358Weakness · CWE-358

CVE-2026-48797

CRITICAL · 9.3 CVSS v4.0 Published 2026-06-17
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing flags intended as security controls: --auth user:pass — documented as "require HTTP Basic authentication on every request to the UI." and--share — documented as "expose the UI on a public address; requires --auth." When --auth user:pass is passed, the CLI prints Auth: enabled (user: <username>) to confirm to the operator that authentication is active, then exports BACKPROPAGATE_UI_AUTH=user:pass to the subprocess that launches the Reflex backend. The Reflex backend (backpropagate/ui_app/**) never reads BACKPROPAGATE_UI_AUTH. No authentication middleware is registered. No request-level guard runs. No WebSocket upgrade guard runs. Any client that reaches the bound port — local or remote, depending on whether --share is used — has full UI access. An inline comment at backpropagate/cli.py:1217-1218 in the v1.1.0 source documents the gap: "For Phase 1 the variable is exported but Reflex doesn't read it yet." This comment was internal-facing; the user-facing documentation (README, CHANGELOG, SHIP_GATE) advertised the contract as enforced. An attacker who reaches the bound port can read uploaded datasets, trigger arbitrary training runs against any local base models as well as read their paths, trigger HuggingFace Hub pushes and cause disk-fill DoS. This issue has been fixed in version 1.2.0. If developers cannot immediately upgrade to 1.2.0 run backprop ui with no flags so it binds to localhost, use SSH port-forwarding (ssh -L 7860:localhost:7860 <training-host>) instead of --share for remote access, and audit any host previously launched with --share, re-issuing any HF tokens used during those sessions.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Backpropagate library's Reflex web UI has a critical authentication bypass vulnerability. Despite the CLI accepting --auth user:pass flag to enable HTTP Basic authentication, the Reflex backend never reads the BACKPROPAGATE_UI_AUTH environment variable exported by the CLI. No authentication middleware is registered, granting anyone who reaches the bound port full access to training controls, dataset uploads, model loading, and HuggingFace Hub operations.

MitigationUpgrade to version 1.2.0 immediately. If unable to upgrade, run backprop ui with no flags (localhost-only) and use SSH port-forwarding instead of --share; audit any hosts previously launched with --share and re-issue any HF tokens used during those sessions.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify if Backpropagate UI was recently used
    Check command history or running processes for 'backprop ui' or 'backpropagate ui' commands. Look for any process listening on common web ports (default 8000) that matches backpropagate.
    Affected if The UI has been run on the system at any point.
  2. Determine installed version
    Run 'pip show backpropagate' or 'pip show backprop' to check the installed version. Compare to 1.2.0 as the fixed release.
    Affected if Installed version is below 1.2.0.
  3. Check if --auth flag was used
    Review command history or any scripts/automation that invokes 'backprop ui' for the presence of the --auth user:pass argument.
    Affected if --auth was used, because the vulnerability allows the flag to be accepted without actually enforcing authentication.
  4. Verify network exposure
    Check if the UI was launched with --share flag or with a custom host binding that exposes the port beyond localhost. Inspect the original command for flags like --host 0.0.0.0 or --share.
    Affected if The UI was accessible over the network (non-loopback interface) or --share was used, allowing external attackers to reach the unauthenticated endpoint.
  5. Test authentication enforcement
    If the UI is currently running, attempt to access it from another host or localhost without providing credentials. If authentication is not required to access training controls, dataset uploads, or model operations, the vulnerability is present.
    Affected if Full access to all UI functions is granted without any HTTP Basic auth challenge.

You are affected if you ran backpropagate UI version below 1.2.0, regardless of whether --auth was specified, and especially if the UI was network-accessible.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade to version 1.2.0 immediately. If unable to upgrade, run backprop ui with no flags (localhost-only) and use SSH port-forwarding instead of --share; audit any hosts previously launched with --share and re-issue any HF tokens used during those sessions.

Recommended fix High confidence

1.2.0

  1. Upgrade backpropagate to version 1.2.0 or later: pip install backpropagate>=1.2.0
  2. If immediate upgrade is not possible, run `backprop ui` without any flags so it binds to localhost only (avoid --share)
  3. For remote access instead of using --share, use SSH port-forwarding: ssh -L 7860:localhost:7860 <training-host>
  4. Audit any host that was previously launched with the --share flag
  5. Re-issue any HuggingFace tokens that were used during sessions on hosts exposed via --share

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA2.0 h
9.0 hours of engineering $1,620
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,592.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-48797 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-48797 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data