All vulnerabilities
CVE-2025-49652GHSA-ww28-4m4v-cq4jPYSEC-2026-290

backend.ai: BackendAI Missing Authentication for Critical Function

Lablup backend.aipipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 9 Jun 2025. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in25.15.6Also 25.19.0rc1GitHub
Published9 Jun 2025Updated 27 Oct 2026CVE List

What fixes it

  • 25.15.6backend.ai, pipGitHub
  • 25.19.0rc1backend.ai, pipGitHub
  • 25.15.6BackendAICVE List
  • 25.15.6backend-ai, PyPIOSVpip install "backend-ai>=25.15.6"
  • 25.19.0rc1backend-ai, PyPIOSVpip install "backend-ai>=25.19.0rc1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

Text from CVE List

Affected versions 22

  • backend.ai, pip< 25.15.6GitHub
  • backend.ai, pip>= 25.16.0rc1, < 25.19.0rc1GitHub
  • BackendAIaffected: * before 25.15.6CVE List
  • backend-ai, PyPIfrom first release, fixed in 25.15.6OSV
  • backend-ai, PyPI1.0.0OSV
  • backend-ai, PyPI1.0.1OSV
  • backend-ai, PyPI1.0.2OSV
  • backend-ai, PyPI1.1.0OSV
  • backend-ai, PyPI1.2.0OSV
  • backend-ai, PyPI1.3.0OSV
  • backend-ai, PyPI1.4.0OSV
  • backend-ai, PyPI18.12.0OSV
  • backend-ai, PyPI19.3.0OSV
  • backend-ai, PyPI19.3.0a1OSV
  • backend-ai, PyPI19.9.0OSV
  • backend-ai, PyPI20.3.0OSV
  • backend-ai, PyPI20.3.1OSV
  • backend-ai, PyPI20.9.0OSV
  • backend-ai, PyPI20.9.0a1.dev0OSV
  • backend-ai, PyPI21.3.0OSV
  • backend-ai, PyPI22.3.0OSV
  • backend-ai, PyPIfrom 25.16.0rc1, fixed in 25.19.0rc1OSV

References 10