Backpropagate v1.1.x Web UI Authentication Bypass and Authorization Failure

Vulnerability Overview In versions 1.1.0 through 1.1.9 of , the optional Reflex Web UI (installed via and launched via ) exposes a training control plane, including dataset uploads, model loading, training initiation, multi-run orchestration, GGUF export, and HuggingFace Hub pushing. The CLI accepts two operator flags intended for security control: : Documented as "HTTP Basic Authentication required on every request." : Documented as "Expose UI on a public address, requires ." When is passed, the CLI does set to confirm the operator is authenticated; however, it exports to child processes, causing the Reflex backend to be bypassed. The Reflex backend ( ) never reads , registers no authentication middleware, has no request-level guards, and lacks WebSocket upgrade guards. Any client reaching the bound port (local or remote) has full UI access. Impact Scope An attacker can: Read uploaded datasets, including any JSON/CSV/TEXT files legitimately uploaded by the operator for fine-tuning. Trigger arbitrary training runs against any base model installed locally by the operator or downloadable from HuggingFace. Trigger HuggingFace Hub pushes, using repository names specified via the UI input (subject to the scope of the operator's local HF token, which typically covers all repositories owned by the operator). Cause disk-filling DoS via the endpoint (no size limits, no extension filters, no per-user count limits, unlike the per-user count in v1.1.0/v1.1.1). Read model paths ( , , ) using user-supplied inputs that bypass the helper located in (path validation was dead code in v1.1.0/v1.1.1). Unauthenticated training control, HF push target spoofing, and path input traversal affected endpoints suitable for data exfiltration (reading uploaded training data) and supply chain attacks (pushing tampered model weights to the operator's HF account). Local defaults (no ) reduce exposure to hosts outside the warning. The flag is documented as a "public URL" feature; users employing without receive no warning and assume authentication is in place. Remediation Fixed in v1.2.0 (released 2026-05-23). The patch implements true ASGI middleware , which gates both HTTP routes and WebSocket upgrades. Four modes ( , , , ) use HMAC-signed cookie validation for . Host and origin whitelisting are enforced. The middleware is deployed with four layers of defense-in-depth across , , , and the surface, so direct Python invocations (bypassing UI guards) also enforce authentication. Upgrade commands: Full release notes: https://github.com/mcp-tool-shop-org/backpropagate/blob/main/CHANGELOG.md#120---2026-05-23 Workaround If immediate upgrade is not possible: 1. Do not pass or to . Run the UI without flags ( ), which will bind to and accept any client capable of reaching . 2. For remote access, use SSH port forwarding instead of : SSH provides an authentication layer that the Reflex UI lacks. 3. Audit existing deployments. If any instances previously run with were started, any training data, model paths, or HF push targets accessed during a UI session may have been exposed. Revoke and reissue HF tokens used during such sessions. Binary Distribution Vulnerability Standalone binaries (Windows / macOS built by PyInstaller) failed to build v1.2.0 and will appear in subsequent patch releases. In the interim, users relying on v1.1.x binary distributions should install the patched version via to receive the authentication bypass fix. Both the v1.2.0 PyPI package and the RPM package contain the patched code. Discovery Discovered by dogfood-swarm Stage A audit on 2026-05-22 (Discovery ID FR09TEN0-A-091, classified as CRITICAL). The audit also identified discrepancies with those documented in , which were corrected alongside runtime fixes in v1.2.0.

Goal Reached Thanks to every supporter — we hit 100%!

Backpropagate v1.1.x Web UI Authentication Bypass and Authorization Failure

More from this source