API Key Exposure in Lunary AI Version 1.4.29
CVE-2024-9099

8.1HIGH

Key Information:

Vendor

Lunary-ai

Status
Lunary-ai/lunary
Vendor
CVE Published:
20 March 2025

What is CVE-2024-9099?

In Lunary AI v1.4.29, the /projects API endpoint unintentionally exposes both public and private API keys, allowing users with minimal permissions, like Viewers or Prompt Editors, to access sensitive credentials. This significant exposure can lead to unauthorized actions being performed on behalf of projects, including the access of confidential data and potential deletion of project resources. The sensitive keys are discoverable through developer tools when the endpoint is accessed from the frontend, posing a substantial risk to project integrity and security.

Affected Version(s)

lunary-ai/lunary < 1.5.7

References

https://huntr.com/bounties/ffb84fe8-3e60-4200-ac2d-1fd1e1...
https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.