CVE-2024-9099: lunary — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-9099

CVSS 8.1 · High EPSS 0,60%

Kerentanan Exposure of Sensitive Information Through Metadata pada lunary. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.

Rincian

Terbit di NVD: 20 Maret 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1230: Exposure of Sensitive Information Through Metadata
EPSS (30 hari): 0,60% peluang dieksploitasi; lebih tinggi dari 47,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lunary	lunary	Versi 1.4.29

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc patch
https://huntr.com/bounties/ffb84fe8-3e60-4200-ac2d-1fd1e1c93e91 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.