GHSA-hxvr-gg2w-j48xHighCVSS 8.0

BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Published
June 9, 2025
Last Modified
January 21, 2026

🔗 CVE IDs covered (1)

📋 Description

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.

NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from https://github.com/lablup/backend.ai/pull/7587 in their instances to protect themselves from the conditions that would lead to the situation described in the CVE record.

🎯 Affected products1

  • pip/backend.ai:<= 25.3.3

🔗 References (5)