CVE-2024-9095 is a critical (CVSS 9.8) missing authorization flaw in lunary-ai/lunary v1.4.28. The /bigquery API route lets any logged in user create a Datastream to Google BigQuery and export the entire database, including password hashes and secret API keys. Update to a version that includes the fix commit.
What's affected
The record names lunary-ai/lunary version v1.4.28, an observability tool for LLM applications. The route in question is /bigquery.
The description says the route is guarded by a configuration check, config.DATA_WAREHOUSE_EXPORTS_ALLOWED, but it does not check the access level of the user and does not use access control middleware. So if the feature is enabled, any account with a login can create a Datastream and export the whole database.
The record says the exported data can include password hashes and secret API keys, and that the weakness could lead to credential compromise and service integrity problems. The reference list includes an upstream commit, which we could not retrieve, so the exact fixed release is not confirmed here. Check the Lunary releases for the version that contains that commit.
How to check if you're exposed
Check which version you run. For a self hosted install, look at the version shown in the dashboard, the image tag in your compose or Kubernetes files, or the version in your package manifest.
Then check whether the data warehouse export setting is on. The record names the setting DATA_WAREHOUSE_EXPORTS_ALLOWED. Look for it in your environment variables and configuration files. If it is not enabled, the route is gated by that check, although upgrading is still wise.
Finally, review your users. The weakness needs a logged in account, so list who has one, including project members and invited guests, and look for unexpected Datastream or BigQuery configuration in your Google Cloud project.
What to do now
- Find Lunary installs and confirm the version.
- Update to a release that contains the access control fix.
- Turn off the data warehouse export feature if you do not use it.
- Review the user list and remove accounts that should not have access.
- Rotate API keys and force password resets if the export feature was on while the version was affected.
- Check your Google Cloud project for data streams you did not create.
Why it matters
This is a missing authorization bug. The code confirmed that the feature was switched on, but never asked whether the person calling it was allowed to use it. Authentication, knowing who you are, and authorization, knowing what you may do, are different checks, and routes often get one without the other.
The impact is high because the export covers the whole database, and databases for tools like this hold the keys to other systems. The fix pattern is a role check on every route that moves data out, applied by shared middleware so that a new route cannot forget it.
The weakness class is CWE-862: Missing Authorization. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
Yes. The record says any logged in user. That is a low bar on systems with open sign up.
What data is at risk?
The record says the entire database, including password hashes and secret API keys.
Sources
Last reviewed: 19 October 2026.
