HIGH8.1

PYSEC-2026-1210

Backend.AI Missing Authorization vulnerability

Details

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.

NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from https://github.com/lablup/backend.ai/pull/7587 in their instances to protect themselves from the conditions that would lead to the situation described in the CVE record.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/backend-ai

Introduced in: 0

No fixed version published yet for backend-ai (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-49651[ADVISORY]
https://github.com/lablup/backend.ai/pull/7587[WEB]
https://github.com/lablup/backend.ai[PACKAGE]
https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653[WEB]
https://hiddenlayer.com/sai_security_advisor/2025-06-backendai[WEB]
https://pypi.org/project/backend-ai[PACKAGE]
https://github.com/advisories/GHSA-h889-475r-wfmm[ADVISORY]