high8.0
CVE-2025-49653
BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Impact
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from https://github.com/lablup/backend.ai/pull/7587 in their instances to protect themselves from the conditions that would lead to the situation described in the CVE record.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | backend.ai | <= 25.3.3 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/
- https://github.com/advisories/GHSA-hxvr-gg2w-j48x
- https://nvd.nist.gov/vuln/detail/CVE-2025-49653
- https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653
- https://hiddenlayer.com/sai_security_advisor/2025-06-backendai
- https://github.com/lablup/backend.ai/pull/7587