Authentication Bypass in Backpropagate Training Control UI

CVE-2026-48797

What is CVE-2026-48797?

The Backpropagate library, utilized for fine-tuning large language models, suffers from an authentication bypass in its Reflex web UI as of versions 1.1.0 and 1.1.1. This vulnerability allows unauthenticated access to critical features such as dataset uploads and model executions. Despite the presence of CLI options intended to enforce authentication, the Reflex backend does not properly implement these security controls, permitting unauthorized users full UI access to interact with sensitive training data. This flaw can lead to unauthorized training runs and potential denial of service through disk space exhaustion. Affected users are encouraged to upgrade to version 1.2.0 to mitigate this risk.

References