Backpropagate (single-GPU LLM fine-tuning library) - Reflex web UI: The optional web UI exposes a training control

Impact

The optional web UI exposes a training control surface without authentication, scored 9.3. On a GPU box this means an unauthenticated caller drives training jobs on your hardware - the practical outcomes are GPU theft for someone else's workload, poisoning of a fine-tune in progress, and read access to whatever the training process can see.

Who can reach it

Network, unauthenticated. Anyone who can reach the UI port. Fine-tuning UIs get bound to 0.0.0.0 during experimentation far more often than anyone admits.

What to do

Upgrade past 1.1.1, or disable the Reflex web UI entirely if you do not use it. Cost: restart the service. The standing control is a network policy that stops research workloads binding tooling ports to anything but localhost.

References

Related entries

• Assisted Migration Agent (hardcoded insecure TLS to vCenter): The agent hardcodes insecure TLS when talking to vCenterCVE-2026-53475 · Assisted Migration Agent (hardcoded insecure TLS to vCenter)Critical
• Linux liquidio driver (Marvell/Cavium, cached VF pci_dev lookup table): The LiquidIO PF caches VF `pci_dev` pointersCVE-2026-72329 · Linux liquidio driver (Marvell/Cavium, cached VF pci_dev lookup table)Critical
• Dell Secure Connect Gateway: exposed Docker socket gives a local user or container host rootCVE-2026-80238 · Dell Secure Connect Gateway 5.0 (orchestrator container / exposed Docker socket)Critical
• MinIO (OIDC authentication): JWT algorithm confusion in the OIDC login path lets an attacker present a token the serverCVE-2026-33322 · MinIO (OIDC authentication)Critical
• rclone (rc API, options/set): options/set is exposed pre-authentication and can rewrite the running instance's authCVE-2026-41176 · rclone (rc API, options/set)Critical
• rclone (rc API, operations/fsinfo): operations/fsinfo is reachable without authentication and accepts anCVE-2026-41179 · rclone (rc API, operations/fsinfo)Critical