점검 대응긴급KEV 미등록
CVE-2026-48797
mcp-tool-shop-org backpropagate, @mcptoolshop/backpropagate 취약점
Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing flags intended as security controls: --auth user:pass — documented as "require HTTP Basic authentication on every request to the UI." and--share — documented as "expose the UI on a public address; requires --auth." When --auth user:pass is passed...
- 대응 우선순위
- 점검
- CVSS
- 9.3
- EPSS
- 0.32% 백분위 24.9% · 2026.08.02 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.06.17