CVE-2025-27621

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using these two primitives, any website can make a authenticated cross-origin request to the UpTrain instance by providing the default API key in the header `uptrain-access-token`. This issue may allow arbitrary websites to perform privileged operations on the UpTrain instance, as if they were the default logged in user. As of time of publication, no known patches are available.

CVSS

No CVSS.

References

Link	Resource
https://github.com/uptrain-ai/uptrain/blob/a31cc14eddcb6c0b0b12cbed15f086d98c441c6f/uptrain/dashboard/backend/app.py#L105
https://securitylab.github.com/advisories/GHSL-2024-198_GHSL-2024-199_Uptrain/

Configurations

No configuration.

History

29 Sep 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) UpTrain es una plataforma de código abierto para evaluar y mejorar aplicaciones de IA generativa. En la versión 0.7.1 y anteriores, el backend de UpTrain crea un nuevo usuario predeterminado con un nombre de usuario estático, donde el nombre de usuario también se utiliza como clave API predeterminada. El backend de UpTrain también tiene una política CORS abierta. Utilizando estas dos primitivas, cualquier sitio web puede realizar una solicitud autenticada de origen cruzado a la instancia de UpTrain proporcionando la clave API predeterminada en el encabezado 'uptrain-access-token'. Este problema puede permitir a sitios web arbitrarios realizar operaciones privilegiadas en la instancia de UpTrain, como si fueran el usuario predeterminado con sesión iniciada. Hasta el momento de la publicación, no hay parches conocidos disponibles.

Information

Published : 2026-08-17 16:16

Updated : 2026-09-29 10:10

NVD link : CVE-2025-27621

Mitre link : CVE-2025-27621

CVE.ORG link : CVE-2025-27621

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-27621", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27621", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T15:58:11.831525Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "uptrain-ai", "product": "uptrain", "versions": [{"status": "affected", "version": "<= 0.7.1"}]}]}], "published": "2026-08-17T16:16:46.290", "references": [{"url": "https://github.com/uptrain-ai/uptrain/blob/a31cc14eddcb6c0b0b12cbed15f086d98c441c6f/uptrain/dashboard/backend/app.py#L105", "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2024-198_GHSL-2024-199_Uptrain/", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using these two primitives, any website can make a authenticated cross-origin request to the UpTrain instance by providing the default API key in the header `uptrain-access-token`. This issue may allow arbitrary websites to perform privileged operations on the UpTrain instance, as if they were the default logged in user. As of time of publication, no known patches are available."}, {"lang": "es", "value": "UpTrain es una plataforma de c\u00f3digo abierto para evaluar y mejorar aplicaciones de IA generativa. En la versi\u00f3n 0.7.1 y anteriores, el backend de UpTrain crea un nuevo usuario predeterminado con un nombre de usuario est\u00e1tico, donde el nombre de usuario tambi\u00e9n se utiliza como clave API predeterminada. El backend de UpTrain tambi\u00e9n tiene una pol\u00edtica CORS abierta. Utilizando estas dos primitivas, cualquier sitio web puede realizar una solicitud autenticada de origen cruzado a la instancia de UpTrain proporcionando la clave API predeterminada en el encabezado 'uptrain-access-token'. Este problema puede permitir a sitios web arbitrarios realizar operaciones privilegiadas en la instancia de UpTrain, como si fueran el usuario predeterminado con sesi\u00f3n iniciada. Hasta el momento de la publicaci\u00f3n, no hay parches conocidos disponibles."}], "lastModified": "2026-09-29T10:10:00.263", "sourceIdentifier": "security-advisories@github.com"}