Uptrain Zero-Click RCE and Default API Key Vulnerabilities (CVE-2025-27621/27770)

Vulnerability Overview Vulnerability ID: GHSL-2024-198, GHSL-2024-199 CVE IDs: CVE-2025-27621, CVE-2025-27770 Vulnerability Type: Zero-click Remote Code Execution (RCE) Affected Project: Uptrain Tested Version: v0.7.1 Impact Scope Issue 1: Default API Key - The Uptrain backend uses a static username when creating new users, and this username is also used as the default API key. - An open CORS policy allows any website to make cross-origin requests by providing the default API key. - Impact: Any website may perform privileged operations on the Uptrain instance as the default logged-in user. Issue 2: Remote Code Execution - The endpoint contains a Remote Code Execution (RCE) vulnerability via the and parameters. - Impact: Any user with access to Uptrain and a valid authentication method may execute arbitrary code, affecting the host running Uptrain (typically a Docker container). Remediation Issue 1: Default API Key - Avoid using static usernames as default API keys. - Restrict the CORS policy to only allow trusted domains. Issue 2: Remote Code Execution - Strictly validate the and parameters to prevent code injection. - Use safe code execution methods and avoid directly executing user input. POC Code Contact Information Contact: Kevin Stubbings Email: securitylab@github.com Reference ID: GHSL-2024-198 or GHSL-2024-199 Credits Discovered by: GHSL Team Member @Kwstubbings (Kevin Stubbings) Timeline 2024-09-05: Issue opened in the repository; maintainers did not respond. 2025-03-10: Uptrain Slack message indicated the project is no longer maintained. 2025-08-10: Pull request with fix opened in the repository. Summary Uptrain has two critical vulnerabilities: a default API key and Remote Code Execution. These vulnerabilities could allow any website to perform privileged operations and achieve remote code execution. It is recommended to fix these issues as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Uptrain Zero-Click RCE and Default API Key Vulnerabilities (CVE-2025-27621/27770)

More from this source