Lunary 1.4.29
Approved changes feed: RSS · Atom
cpe:2.3:a:lunary:lunary:1.4.29:*:*:*:*:*:*:*part: a version: 1.4.29 update: *
| Vendor | Lunary (d06a62eb-8728-5903-8388-539ff39c70e6) |
|---|---|
| Product | Lunary (8681bafc-d844-59ba-bfe1-ff3e7976ea73) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/lunary-ai/lunary |
purl2cpe | 2026-06-01 10:12:14.765575 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-9099 |
vulnerable | 2026-06-08 07:00:26.654970 |
Exposure of Private API Keys in lunary-ai/lunary
HIGH (8.8)
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.
Published: 2025-03-20T10:10:37.881Z
Updated: 2025-03-20T18:18:54.916Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.