Live › vulnerability › CVE-2025-49652
Go to dashboardBackend.AI's registration feature lacks an authentication check, so any person can create a user account. Those accounts can reach private data even when the operator has turned registration off.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:18 UTC, 0h before NVD. All times on this page are UTC.
Deployments of the Backend.AI platform from pypi package backend.ai that run a version before 25.15.6, or from 25.16.0rc1 before 25.19.0rc1. The sources do not say which configurations are exposed beyond the registration feature, so the exact exposure is unknown. Teams that run a patched release or do not run Backend.AI can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| backend.ai | pypi | < 25.15.6 | 25.15.6 |
| backend.ai | pypi | >= 25.16.0rc1, < 25.19.0rc1 | 25.19.0rc1 |
backend.ai package with pip show backend.ai and compare it with the fixed versions below.backend.ai to 25.15.6 on the 25.15 line, or to 25.19.0rc1 on the 25.16 to 25.19 range.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
This page as .md · .json · in your agent: get_signal("CVE-2025-49652")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.