AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ClearMLGHSA-gvqv-h7hh-6fcc

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

ClearML

CVE-2024-24595 · Published Feb 6, 2024 · updated Jul 7, 2026

Medium6.0
No fix yet
GitHub advisory

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

Affected versions

PackageAffectedFixed in
clearml
PyPI
<= 1.14.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-312, CWE-522
Also known as
CVE-2024-24595, PYSEC-2026-1257

More ClearML advisories

All ClearML