Executive brief
Backpropagate is a tool used for managing and training AI models. A security flaw in its web interface allows anyone with network access to bypass authentication, even when a password is set. This could allow an attacker to steal private training data, hijack model training processes, or tamper with models uploaded to public repositories like HuggingFace.
Technical details
In Backpropagate versions 1.1.0 through 1.1.1, the '--auth' and '--share' CLI flags fail to implement actual security controls. While the CLI accepts credentials and exports them as environment variables, the Reflex backend lacks the necessary middleware to read these variables or gate requests. Consequently, all HTTP routes and WebSocket upgrades are unauthenticated. An attacker can exploit this to read uploaded datasets, trigger arbitrary training runs, push tampered models to HuggingFace using the operator's local tokens, and perform path traversal or denial-of-service attacks. The issue is fixed in version 1.2.0 by implementing ASGI middleware for authentication and WebSocket guards.
Affected products
- mcp-tool-shop-org backpropagate >= 1.1.0, < 1.2.0
- mcp-tool-shop-org @mcptoolshop/backpropagate >= 1.1.0, < 1.2.0
Timeline
- 2026-05-22: other: Vulnerability discovered during audit
- 2026-05-23: patched: Version 1.2.0 released
- 2026-06-17: advisory: NVD publication
- 2026-06-26: disclosed: GitHub Advisory published