CVE-2025-27621 in UpTrain
Summary
by MITRE • 08/17/2026
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using these two primitives, any website can make a authenticated cross-origin request to the UpTrain instance by providing the default API key in the header `uptrain-access-token`. This issue may allow arbitrary websites to perform privileged operations on the UpTrain instance, as if they were the default logged in user. As of time of publication, no known patches are available.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified within UpTrain versions 0.7.1 and prior represents a critical intersection of insecure credential management and permissive cross-origin resource sharing policies. This flaw fundamentally undermines the authentication model of the platform by allowing unauthenticated or improperly authenticated actors to assume administrative privileges through simple web-based requests. The core technical issue stems from two distinct but compounding misconfigurations: the use of static, predictable credentials for default user accounts and an overly permissive CORS policy that fails to restrict which origins can submit these credentials.
At the heart of this vulnerability is the creation of a new default user account upon installation or initialization of the UpTrain backend service. This default user is assigned a hardcoded username that serves dual purposes as both the login identifier and the API authentication token. By using the same string for identity verification and access control, the system creates a static secret that does not change between deployments unless explicitly modified by an administrator. In security architecture, relying on static secrets rather than dynamic tokens or unique per-instance keys is considered a severe anti-pattern because it eliminates entropy from the authentication process. Attackers can easily discover this default credential through documentation, source code inspection, or simple enumeration attempts, as there is no mechanism to rotate these values automatically upon deployment.
Compounding the issue of static credentials is the configuration of the Cross-Origin Resource Sharing policy on the UpTrain backend server. CORS is a browser security feature that restricts how resources on a web page can be requested from another domain. In this case, the server is configured with an open or wildcard origin policy, effectively allowing any website to make cross-origin requests to the UpTrain API endpoint without being blocked by modern browsers' same-origin policy protections. When combined with the static default credentials, this configuration allows malicious websites to craft HTTP POST or GET requests that include the header uptrain-access-token containing the known default username and key. The browser permits these requests to be sent due to the permissive CORS settings, and the UpTrain backend accepts them as valid authentication because it trusts any request carrying the correct static token.
The operational impact of this vulnerability is severe, enabling arbitrary websites to perform privileged operations on behalf of the default user without explicit consent or interaction from a legitimate administrator. An attacker can host a malicious webpage that automatically sends requests to an UpTrain instance in the background when visited by a victim who has administrative access to such instances, or simply target public-facing deployments directly. This allows for unauthorized data exfiltration, modification of evaluation datasets, injection of poisoned prompts into generative AI pipelines, and potentially complete compromise of the underlying infrastructure if the default user possesses elevated system permissions. The attack vector is particularly dangerous because it does not require social engineering beyond hosting a malicious site; it relies entirely on technical misconfiguration that can be exploited programmatically at scale.
From an industry standards perspective, this vulnerability maps directly to CWE-798: Use of Hard-coded Credentials and CWE-201: Insertion of Sensitive Information into Sent Data via CORS Misconfiguration. It also aligns with MITRE ATT&CK techniques related to Credential Access and Defense Evasion, specifically leveraging trusted relationships or misconfigured trust boundaries to bypass authentication controls. The lack of origin validation in the API layer means that the principle of least privilege is violated, as any source can act as a privileged client.
Mitigation strategies must address both aspects of this flaw immediately since no official patches are currently available for version 0.7.1 and prior. Administrators should first disable or restrict access to the UpTrain backend if it does not need to be publicly accessible on the internet. If public access is required, the CORS policy must be hardened by explicitly whitelisting only trusted domains rather than allowing all origins. Furthermore, the default user account must be disabled entirely or have its credentials changed to a strong, unique password and API key that differs from the username. Implementing rate limiting and monitoring for unusual cross-origin request patterns can also help detect exploitation attempts in real-time until permanent fixes are deployed by the vendor.