CVE-2026-48797 affects the backpropagate Python library versions before 1.2.0. The Reflex web UI component intended to provide training controls is exposed without authentication even when the CLI flag --auth user:pass is used. The CLI exports an environment variable BACKPROPAGATE_UI_AUTH to the Reflex backend to enforce HTTP Basic authentication, but the backend does not read this variable and does not implement any authentication middleware or request guards. Consequently, any client able to connect to the UI port can perform sensitive operations such as dataset upload, model loading, training control, multi-run orchestration, GGUF export, and pushing models to the HuggingFace Hub. The documentation incorrectly states that authentication is enforced. This security flaw allows unauthorized access and potential denial-of-service via disk fill. The issue was resolved in version 1.2.0.

An attacker with network access to the Reflex UI port can bypass authentication controls and gain full access to the training control plane. This includes reading uploaded datasets, triggering arbitrary training runs on local models, reading model paths, pushing models to the HuggingFace Hub, and causing denial-of-service conditions by filling disk space. The vulnerability compromises confidentiality, integrity, and availability of the training environment.

This vulnerability is fixed in backpropagate version 1.2.0. Users should upgrade to version 1.2.0 or later to ensure the Reflex UI enforces authentication as documented. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version fix note.