CVE-2026-48797: Backpropagate Auth Bypass Vulnerability

CVE-2026-48797 Overview

CVE-2026-48797 is a missing authentication vulnerability in Backpropagate, a Python library for fine-tuning large language models on a single GPU. Versions 1.1.0 and 1.1.1 ship an optional Reflex-based web UI that exposes a training control plane with no authentication enforcement. The CLI advertises --auth user:pass and --share flags as security controls, but the Reflex backend never reads the BACKPROPAGATE_UI_AUTH environment variable. Any client reaching the bound port gains full control over dataset uploads, model loading, training orchestration, GGUF export, and HuggingFace Hub push operations. The issue is tracked under [CWE-358] and is resolved in version 1.2.0.

Critical Impact
Unauthenticated network attackers can read uploaded datasets, trigger arbitrary training runs against local base models, push artifacts to HuggingFace, and cause disk-fill denial of service.

Affected Products

Backpropagate 1.1.0
Backpropagate 1.1.1
Reflex web UI component (backpropagate/ui_app/**)

Discovery Timeline

2026-06-17 - CVE-2026-48797 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48797

Vulnerability Analysis

The vulnerability stems from an incomplete implementation of an advertised security control. The CLI accepts --auth user:pass and prints Auth: enabled (user: <username>) to confirm authentication is active. It then exports BACKPROPAGATE_UI_AUTH=user:pass into the subprocess that launches the Reflex backend.

The Reflex backend never reads BACKPROPAGATE_UI_AUTH. No authentication middleware is registered, no request-level guard executes, and no WebSocket upgrade guard runs. The contract documented in the README, CHANGELOG, and SHIP_GATE is unenforced at runtime. An inline comment at backpropagate/cli.py:1217-1218 acknowledges the gap as a Phase 1 limitation, but this remark was never surfaced to operators.

The Reflex control plane exposes dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push functionality. With --share enabled, the UI binds to a public address under the false assumption that --auth enforcement is in effect.

Root Cause

The root cause is improperly implemented security check for a standard [CWE-358]. The CLI provides operators with a security flag that produces visible confirmation output, while the downstream Reflex application skips the corresponding enforcement code path entirely.

Attack Vector

Exploitation requires only network reachability to the Reflex bound port. When operators run backprop ui --share --auth user:pass, the UI is published to a public network address with zero authentication. An attacker who connects to the port has the same privileges as the operator: arbitrary training jobs, filesystem disclosure of local model paths, HuggingFace token abuse via Hub push, and resource exhaustion through repeated training runs.

The vulnerability is exploitable without user interaction or prior credentials. No exploitation code is required because the UI endpoints accept requests directly.

Detection Methods for CVE-2026-48797

Indicators of Compromise

Unexpected training jobs initiated through the Reflex UI from unrecognized source IP addresses.
HuggingFace Hub push events originating from training hosts during sessions launched with --share.
Disk usage spikes on training hosts corresponding to attacker-triggered model runs or dataset uploads.
Outbound connections from training hosts to unfamiliar HuggingFace repositories.

Detection Strategies

Inventory hosts running Backpropagate 1.1.0 or 1.1.1 and identify any process bound to the Reflex port (default 7860).
Search shell history and process telemetry for invocations of backprop ui --share and treat those hosts as previously exposed.
Review HuggingFace Hub audit logs for push events originating from tokens issued to training hosts during the exposure window.

Monitoring Recommendations

Alert on inbound connections to the Reflex UI port from non-loopback addresses.
Monitor for new processes spawned by the Reflex backend that load base models or write GGUF artifacts unexpectedly.
Track HuggingFace token usage and revoke tokens that were active on hosts launched with --share.

How to Mitigate CVE-2026-48797

Immediate Actions Required

Upgrade Backpropagate to version 1.2.0 on every host running the Reflex UI.
Audit any host previously launched with --share and treat the training control plane as compromised.
Re-issue HuggingFace tokens that were available to sessions started with --share.
Remove --share from operational runbooks and scheduler configurations until upgrade is complete.

Patch Information

The maintainers fixed the missing authentication enforcement in version 1.2.0. See the GitHub Release v1.2.0 and the GitHub Security Advisory GHSA-f65r-h4g3-3h9h for upgrade guidance and the full disclosure record.

Workarounds

Run backprop ui with no flags so the server binds to localhost only.
Use SSH port-forwarding such as ssh -L 7860:localhost:7860 <training-host> for remote access instead of --share.
Restrict the Reflex port at the host firewall to administrative source addresses until the upgrade is applied.

bash

# Configuration example
# Bind Reflex UI to localhost only (no flags)
backprop ui

# Reach the UI from a workstation via SSH tunnel
ssh -L 7860:localhost:7860 <training-host>

# Then open http://localhost:7860 in the local browser