CVE-2024-1739
Lunary ≤ 1.0.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2024-1739 is a critical-severity Incorrect Synchronization (CWE-821) vulnerability in Lunary Lunary. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Other ATLAS/OWASP Terms risk domain.
The strongest mitigations our analysis identified map to SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-17466
Vulnerability Data
lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address…
more
by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Lunary.ai (lunary-ai/lunary) is an open-source LLM observability and management platform for monitoring, evaluating, and debugging AI/ML applications, categorized as an Other Platforms in the AI ecosystem. The vulnerability is a general authentication flaw reported on an AI/ML bug bounty platform (Huntr).
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-4 directly requires preventing unintended information transfer through shared resources, structurally blocking the concurrent unsynchronized access described by CWE-821.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct concurrency controls and synchronization primitives to prevent race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect synchronization flaws before production deployment.
Secure SDLC practices include concurrency and synchronization requirements that reduce race conditions.
Application security requirements can mandate proper locking and thread-safety controls.
Secure architecture principles address concurrent access and resource synchronization.
Secure coding standards directly require correct synchronization primitives and thread-safety.
Change management processes can introduce or miss synchronization fixes during updates.