CVE-2024-9099— Exposure of Private API Keys in lunary-ai/lunary
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-9099
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Exposure of Private API Keys in lunary-ai/lunary
Source: NVD (National Vulnerability Database)
Vulnerability Description
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1230
Source: NVD (National Vulnerability Database)
Vulnerability Title
Lunary 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Lunary是Lunary开源的一个 LLM 的生产工具包。 Lunary v1.4.29版本存在安全漏洞，该漏洞源于GET /projects API端点向具有最低权限的用户暴露了所有项目的公共和私有API密钥，可能导致敏感凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| lunary-ai | lunary-ai/lunary | unspecified ~ 1.5.7 | - |
II. Public POCs for CVE-2024-9099
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-9099
请登录查看更多情报信息。
Same Patch Batch · lunary-ai · 2025-03-20 · 22 CVEs total
| CVE-2024-11137 | IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary | |
| CVE-2024-9096 | Improper Authorization in lunary-ai/lunary | |
| CVE-2024-9000 | Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary | |
| CVE-2024-9095 | Improper Authorization in lunary-ai/lunary | |
| CVE-2024-9098 | Privilege Escalation in lunary-ai/lunary | |
| CVE-2024-10273 | Improper Privilege Management in lunary-ai/lunary | |
| CVE-2024-10762 | Missing Authorization in lunary-ai/lunary | |
| CVE-2024-10275 | Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary | |
| CVE-2024-10330 | Improper Access Control in lunary-ai/lunary | |
| CVE-2024-10274 | Improper Authorization in lunary-ai/lunary | |
| CVE-2024-10272 | Broken Access Control in lunary-ai/lunary | |
| CVE-2025-0281 | Stored Cross-Site Scripting (XSS) in lunary-ai/lunary | |
| CVE-2024-11301 | Improper Enforcement of Unique Constraint in lunary-ai/lunary | |
| CVE-2024-11300 | Improper Access Control in lunary-ai/lunary | |
| CVE-2024-8789 | Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary | |
| CVE-2024-8763 | Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary | |
| CVE-2024-8764 | Improper Authorization in lunary-ai/lunary | |
| CVE-2024-8998 | Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary | |
| CVE-2024-8999 | Improper Access Control in lunary-ai/lunary | |
| CVE-2024-8765 | Improper Path Equivalence Resolution in lunary-ai/lunary |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: lunary-ai/lunary
- CVE-2024-5386
Account Hijacking via Password Reset Token Leak in lunary-ai - CVE-2024-4147
Insufficient Access Control in lunary-ai/lunary - CVE-2025-9803
Improper Authentication in lunary-ai/lunary - CVE-2025-5352
Environment Variable XSS in Analytics Component in lunary-ai - CVE-2025-4962
IDOR Vulnerability in Template Creation via `projectId` Mani
Same vendor: lunary-ai
- CVE-2024-5386
Account Hijacking via Password Reset Token Leak in lunary-ai - CVE-2024-4147
Insufficient Access Control in lunary-ai/lunary - CVE-2025-9803
Improper Authentication in lunary-ai/lunary - CVE-2025-5352
Environment Variable XSS in Analytics Component in lunary-ai - CVE-2025-4962
IDOR Vulnerability in Template Creation via `projectId` Mani
Same weakness: CWE-1230
- CVE-2025-31959
HCL BigFix Service Management (SM) application fails to stri - CVE-2026-29055
Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Meta - CVE-2026-27661
Siemens SINEC Security Monitor 安全漏洞 - CVE-2025-13084
Opto 22 groov View Exposure of Sensitive Information Through - CVE-2025-30038
Session ID leakage in Zone.Identifier of downloaded files
V. Comments for CVE-2024-9099
No comments yet