CVE-2024-8765: Lunary Auth Bypass Vulnerability

CVE-2024-8765 Overview

CVE-2024-8765 is an authentication bypass vulnerability in lunary-ai/lunary, an open-source platform for large language model (LLM) observability. The flaw resides in the privilege check mechanism at git revision afc5df4. The system classifies any endpoint as public when the request path contains the substring /auth/ at any position. Unauthenticated attackers can craft URLs that embed /auth/ inside otherwise protected paths to reach sensitive endpoints. Successful exploitation allows adversaries to read and modify data belonging to other organizations without valid credentials. The issue is tracked under [CWE-41] and is remotely exploitable over the network without user interaction.

Critical Impact
Unauthenticated attackers can access and modify sensitive data across tenant boundaries by inserting /auth/ into request paths.

Affected Products

lunary-ai/lunary at commit afc5df4
Prior versions inheriting the same route classification logic
Deployments not updated with commit 7ff89b0304d191534b924cf063f3648206d497fa

Discovery Timeline

2025-03-20 - CVE-2024-8765 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8765

Vulnerability Analysis

The vulnerability stems from insecure logic used to classify HTTP routes as public or protected. The application inspects the request path and treats any URL containing /auth/ as an unauthenticated endpoint. This substring match runs against the full path rather than a prefix or an exact match. Attackers append or embed /auth/ inside privileged routes to bypass the authentication middleware entirely. Once the check succeeds, requests reach downstream handlers that assume the caller is already authorized.

The flaw maps to [CWE-41] Improper Resolution of Path Equivalence. Because the privilege gate depends on string containment rather than canonical route matching, semantically distinct routes collide. The vendor patched the issue in commit 7ff89b0. See the Huntr bounty report for additional context.

Root Cause

The root cause is a naive substring test used to identify unauthenticated routes. The middleware checks whether the incoming path contains /auth/ anywhere in its structure. Legitimate authentication endpoints live under /auth/, so the developers exempted the prefix from token verification. The check does not anchor to the start of the path, allowing arbitrary segments to precede or follow the substring.

Attack Vector

Exploitation requires only a crafted HTTP request over the network. An attacker sends a request such as GET /projects/<id>/auth/settings or similar variants that include /auth/ as an interior path segment. The middleware marks the route as public and forwards the request. Backend handlers then serve data or accept mutations without verifying the caller's session or organization membership. No credentials, tokens, or user interaction are required.

Detection Methods for CVE-2024-8765

Indicators of Compromise

Access log entries containing /auth/ embedded inside non-authentication routes such as /projects/, /orgs/, or /runs/
HTTP 200 responses to unauthenticated requests on endpoints that normally require a bearer token
Cross-organization data reads or writes originating from a single source IP within a short window
Requests to lunary endpoints where the Authorization header is absent yet privileged data is returned

Detection Strategies

Inspect reverse proxy and application logs for path patterns matching the regular expression /.+/auth/.+ targeting non-auth handlers
Correlate unauthenticated requests with responses containing organization-scoped identifiers or project data
Compare route access patterns against the expected set of public authentication endpoints defined in the codebase

Monitoring Recommendations

Enable verbose access logging on the lunary API tier and forward events to a centralized log platform for retention and query
Alert on any request lacking session cookies or bearer tokens that returns a 2xx status from a data-plane endpoint
Track baseline request volume per organization and flag deviations that suggest tenant boundary violations

How to Mitigate CVE-2024-8765

Immediate Actions Required

Update lunary-ai/lunary to a build that includes commit 7ff89b0
Audit application and reverse proxy logs for prior requests containing /auth/ inside non-authentication paths
Rotate API keys, session tokens, and organization secrets that may have been exposed through the bypass
Review database records for unauthorized modifications across tenants

Patch Information

The lunary maintainers addressed the flaw in commit 7ff89b0304d191534b924cf063f3648206d497fa. The fix replaces the substring check with an explicit list of public route prefixes anchored at the start of the path. Operators running lunary from source should pull the latest main branch or a tagged release incorporating the commit and redeploy.

Workarounds

Place a reverse proxy in front of lunary that rejects requests where /auth/ appears anywhere except at the start of the path
Enforce authentication at the ingress layer using a web application firewall (WAF) rule set to strip or block anomalous path patterns
Restrict network exposure of the lunary API to trusted networks until the patched build is deployed

bash

# Example NGINX rule blocking embedded /auth/ path segments
location ~ ^/.+/auth/ {
    return 403;
}
location /auth/ {
    proxy_pass http://lunary_backend;
}