KEVWire

Security intelligence, with context.

Response snapshot Oct 27, 2026, 17:26 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-48797

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

In `backpropagate >= 1.1.0`, the optional Reflex web UI (`pip install backpropagate[ui]`, launched via `backprop ui`) exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push.

Published Updated

At a glance

Exploited
Not known
Severity
9.3 Critical (CVSS 4.0)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: backpropagate: 1.2.0; @mcptoolshop/backpropagate: 1.2.0. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-f65r-h4g3-3h9h (opens a new tab)

What happened

## Summary

In `backpropagate >= 1.1.0`, the optional Reflex web UI (`pip install backpropagate[ui]`, launched via `backprop ui`) exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push.

The CLI accepts two operator-facing flags intended as security controls:

- `--auth user:pass` — documented as "require HTTP Basic authentication on every request to the UI." - `--share` — documented as "expose the UI on a public address; requires `--auth`."

Continue reading

When `--auth user:pass` is passed, the CLI prints `Auth: enabled (user: )` to confirm to the operator that authentication is active, then exports `BACKPROPAGATE_UI_AUTH=user:pass` to the subprocess that launches the Reflex backend.

**The Reflex backend (`backpropagate/ui_app/**`) never reads `BACKPROPAGATE_UI_AUTH`.** No authentication middleware is registered. No request-level guard runs. No WebSocket upgrade guard runs. Any client that reaches the bound port — local or remote, depending on whether `--share` is used — has full UI access.

An inline comment at `backpropagate/cli.py:1217-1218` in the v1.1.0 source documents the gap: *"For Phase 1 the variable is exported but Reflex doesn't read it yet."* This comment was internal-facing; the user-facing documentation (README, CHANGELOG, SHIP_GATE) advertised the contract as enforced.

This advisory is filed primarily because the runtime contradicted an operator-facing security claim. Code-only bugs of comparable shape (auth check missing entirely from a path) would already warrant disclosure; the additional false-promise dimension raises the severity.

## Impact

An attacker who reaches the bound port can:

- **Read uploaded datasets** rendered in the UI preview, including content of any JSONL/CSV/TXT file the legitimate operator has uploaded for fine-tuning. - **Trigger arbitrary training runs** against any base model the operator has installed locally or that can be downloaded from HuggingFace.

- **Trigger HuggingFace Hub pushes** to repositories named via the UI input (subject to the operator's local HF token's scope — typically all repos owned by the operator). - **Cause disk-fill DoS** via the `rx.upload` endpoint (no size cap, no extension filter, no per-session count cap in v1.1.0 / v1.1.1).

- **Read model paths** (`source_model_path`, `dataset_path`, `model`, `uploaded_path`) which are user-supplied and bypass the `safe_path()` helper that lives in `backpropagate/ui_security.py` (path validation is dead code on the Reflex surface in v1.1.0 / v1.1.1).

The combination of unauthenticated training control, HF push target spoofing, and path-input traversal makes the affected endpoint suitable for both data exfiltration (reading uploaded training data) and supply-chain attacks (pushing tampered model weights to the operator's HF account).

The local-only default (no `--share`) reduces exposure to a host-local attacker. The `--share` flag is documented as a "public URL" feature; operators who used `--share --auth user:pass` had no warning that the auth half was inert.

## Patches

Fixed in **v1.2.0** (released 2026-05-23). The patch implements real ASGI middleware via `rx.App(api_transformer=basic_auth_transformer)` that gates HTTP routes AND the `/_event` WebSocket upgrade. Four modes (`no_auth_local_only` / `token_auto` / `explicit_creds` / `production`), HMAC-signed cookie validated PRE-`websocket.accept()`, Host + Origin allowlists.

The middleware ships alongside a 4-layer defense in depth at the cli.py / ui_app/app.py / rxconfig.py / env-strip surfaces so direct `python -m reflex run` invocations (bypassing the CLI guard) also enforce authentication.

Upgrade with:

- pip: `pip install --upgrade backpropagate` - npm: `npm install -g @mcptoolshop/backpropagate@latest`

Full release notes: https://github.com/mcp-tool-shop-org/backpropagate/blob/main/CHANGELOG.md#120---2026-05-23

## Workarounds

If users cannot upgrade immediately:

1. **Do not pass `--auth` or `--share` to `backprop ui`.** Run the UI with no flags (`backprop ui`); it will bind to `localhost` and accept any client that can reach `127.0.0.1`. 2. **For remote access, use SSH port-forwarding** instead of `--share`: ``` # On the client: ssh -L 7860:localhost:7860 # On the server: backprop ui # no --share # Then open http://localhost:7860 in your local browser.

``` SSH provides the authentication layer the Reflex UI did not. 3. **Audit existing deployments.** If any host running `backpropagate >= 1.1.0` has previously been launched with `--share`, treat any uploaded training data, model paths, or HF push targets visible in that UI session as potentially exposed. Re-issue HF tokens that have been in use during such sessions.

**Binary distribution gap.** Standalone binaries (Windows .exe / macOS .app via PyInstaller) failed to build for v1.2.0 and will land in a follow-up patch release. In the interim, users who relied on the v1.1.x binary distribution should install the patched version via `pip install backpropagate==1.2.0` to receive the auth-bypass fix. The v1.2.0 PyPI package and `@mcptoolshop/backpropagate@1.2.0` npm package both carry the patched code.

## Credit

Discovered by the dogfood-swarm Stage A audit on 2026-05-22 (finding ID `FRONTEND-A-001`, classified CRITICAL). The audit also surfaced contradicting documentation in CHANGELOG / SHIP_GATE / README; those were corrected in v1.2.0 alongside the runtime fix.

Affected package ranges reported by GitHub: backpropagate: >= 1.1.0, < 1.2.0 @mcptoolshop/backpropagate: >= 1.1.0, < 1.2.0

Scores and how they were measured

CVSS base severity

9.3

Version 4.0As of

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-f65r-h4g3-3h9h (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-f65r-h4g3-3h9h, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 27). Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication (CVE-2026-48797). https://kevwire.com/record/CVE-2026-48797

MLA

"Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication (CVE-2026-48797)." KEVWire, 27 Oct. 2026, kevwire.com/record/CVE-2026-48797.

Chicago

KEVWire. "Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication (CVE-2026-48797)." Last modified October 27, 2026. https://kevwire.com/record/CVE-2026-48797.

Evidence summary (plain text)

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication (Jun 26, 2026).
In `backpropagate >= 1.1.0`, the optional Reflex web UI (`pip install backpropagate[ui]`, launched via `backprop ui`) exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push.

The CLI accepts two operator-facing flags intended as security controls:
CVSS 9.3 (version 4.0; evidence as of Oct 27, 2026; https://github.com/advisories/GHSA-f65r-h4g3-3h9h).
Sources:
GitHub-reviewed advisory GHSA-f65r-h4g3-3h9h: https://github.com/advisories/GHSA-f65r-h4g3-3h9h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-48797.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 27, 2026, 17:25 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail