Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

高危 7.1CVE-2024-24595 · GHSA-gvqv-h7hh-6fcc · PYSEC-2026-1257 · Published 05/02/2024 · updated 17/06/2026

要点

CVE-2024-24595 是影响 clearml 的高危 (CVSS 7.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.26%，高于 17.5% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
clearml PyPI	`≤ 1.14.2`	No fix yet

Description

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

NVD description

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

References

nvd.nist.gov/vuln/detail/CVE-2024-24595 · ADVISORY
allegroai/clearml · PACKAGE
hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain · WEB
hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain · Third Party Advisory
pypi.org/project/clearml · PACKAGE
GitHub Advisory GHSA-gvqv-h7hh-6fcc · ADVISORY

clearml 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

clearml

PyPI

≤ 1.14.2

No fix yet

Description

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

NVD description

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

clearml 的其他漏洞

查看全部 →