CVE-2026-48797

Name of the Vulnerable Software and Affected Versions Backpropagate versions 1.1.0 through 1.1.1

Description The optional Reflex web UI exposes a training control plane without authentication, despite CLI flags --auth and --share suggesting that security controls are active. The Reflex backend fails to read the BACKPROPAGATE UI AUTH variable, meaning no authentication middleware or request-level guards are enforced. An attacker with access to the bound port can read uploaded datasets, trigger arbitrary training runs using local or HuggingFace base models, trigger HuggingFace Hub pushes, and cause a disk-fill Denial of Service (DoS) via the rx.upload endpoint. Additionally, attackers can read model paths such as source model path, dataset path, model, and uploaded path by bypassing the safe path() function.

Recommendations Update Backpropagate to version 1.2.0. As a temporary workaround, run backprop ui without any flags to bind it to localhost. Use SSH port-forwarding instead of the --share flag for remote access. Audit any host previously launched with --share and re-issue any HuggingFace tokens used during those sessions.