CVE-2025-2129

A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. After 7 months of repeated follow-ups by the researcher, Mage AI has decided to not accept this issue as a valid security vulnerability and has confirmed that they will not be addressing it.

• CWE-1188

• https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md
• https://vuldb.com/?ctiid.299049
• https://vuldb.com/?id.299049
• https://vuldb.com/?submit.510690

Published

Mar 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-21284Windows Virtual Trusted Platform Module Denial of Service Vu…5.5
• CVE-2025-21285Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabi…7.5
• CVE-2025-21286Windows Telephony Service Remote Code Execution Vulnerabilit…8.8
• CVE-2025-21287Windows Installer Elevation of Privilege Vulnerability7.8
• CVE-2025-21288Windows COM Server Information Disclosure Vulnerability6.5
• CVE-2025-21289Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabi…7.5
• CVE-2025-21290Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabi…7.5
• CVE-2025-21291Windows Direct Show Remote Code Execution Vulnerability8.8
• CVE-2025-21292Windows Search Service Elevation of Privilege Vulnerability8.8
• CVE-2025-21293Active Directory Domain Services Elevation of Privilege Vuln…8.8
• CVE-2025-21294Microsoft Digest Authentication Remote Code Execution Vulner…8.1
• CVE-2025-21295SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remo…8.1