Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Vulnerability

In backpropagate versions 1.1.0 and 1.1.1, the optional Reflex web UI (pip install backpropagate[ui]) exposes a training control plane without authentication. The CLI accepts --auth user:pass and --share flags intended as security controls, but the Reflex backend never reads the BACKPROPAGATE_UI_AUTH environment variable. No authentication middleware or request-level guard is implemented, leaving the UI fully accessible to any client reaching the bound port. An inline comment in backpropagate/cli.py:1217-1218 acknowledges the gap: "For Phase 1 the variable is exported but Reflex doesn't read it yet." [1]

Exploitation

An attacker who can reach the bound port—locally or remotely if --share is used—can access the UI without any authentication. No user interaction or special privileges are required. The attacker simply connects to the exposed endpoint and gains full control over the training interface. [1]

Impact

Successful exploitation allows an attacker to read uploaded datasets (including JSONL/CSV/TXT files), trigger arbitrary training runs against any locally installed or downloadable base models, initiate HuggingFace Hub pushes, and cause a disk-fill denial of service by repeatedly triggering training runs. [1]

Mitigation

The vulnerability is fixed in version 1.2.0, which implements real ASGI middleware with multiple authentication modes and host/origin allowlists. [2] Operators who cannot immediately upgrade should run backprop ui without --auth or --share flags (binding to localhost only) and use SSH port forwarding (ssh -L 7860:localhost:7860 ) for remote access. Any host previously launched with --share should be audited and HuggingFace tokens used during those sessions should be re-issued. [1]