CVE-2024-24595 Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

What is CVE-2024-24595?

CVE-2024-24595 is a medium-severity vulnerability in Allegro.AI ClearML, published on 5 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

Weakness: CWE-522

Which versions are affected by CVE-2024-24595?

3 open source packages ship an affected version, including clearml. It affects 1 product.

Products include Clear Clearml.

How do I fix CVE-2024-24595?

No fix has been published for CVE-2024-24595 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-24595 being exploited?

There is no known exploitation of CVE-2024-24595 in the wild and no public exploit code.

Other vulnerabilities in Allegro.AI ClearML

• CVE-2024-24594 Cross-site scripting in ClearML Critical 9.9
• CVE-2024-24592 Missing authorization in ClearML Critical 9.8
• CVE-2024-24593 Cross-site request forgery in ClearML Critical 9.6
• CVE-2024-24590 Allegro AI ClearML vulnerable to deserialization of untrusted data High 8.0
• CVE-2024-24591 Allegro AI ClearML path traversal vulnerability High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gvqv-h7hh-6fcc, PYSEC-2026-1257.