CVE-2025-27621

Name of the Vulnerable Software and Affected Versions UpTrain versions prior to 0.7.1

Description The backend creates a default user with a static username that also serves as the default API key. Combined with an open Cross-Origin Resource Sharing (CORS) policy—a mechanism that allows restricted resources on a web page to be requested from another domain—any website can make authenticated cross-origin requests to the instance. This is achieved by providing the default API key in the uptrain-access-token header, potentially allowing arbitrary websites to perform privileged operations as the default user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.