CVE-2024-3408: D-Tale hardcoded SECRET_KEY enables auth bypass and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required, public exploit reference, and very high EPSS make this an urgent patch-first issue.

What it is

man-group/dtale 3.10.0 ships a hardcoded Flask SECRET_KEY, letting attackers forge session cookies when authentication is enabled. The same release fails to restrict custom filter queries, so the /update-settings endpoint can be abused to run arbitrary code even when enable_custom_filters is off. Both flaws combine into full authentication bypass and remote code execution.

Impact

An unauthenticated attacker can forge a valid session, bypass login, and execute arbitrary code on the server, gaining full control of the host and any data it can reach.

Attack surface

Reached over the network via the Flask web interface; the CVSS vector shows no privileges or user interaction required, and the description states the cookie forgery applies when authentication is enabled while the filter bypass works regardless of the enable_custom_filters setting.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.77951 (99.55th percentile) and a public Huntr exploit reference exists, indicating high likelihood of active exploitation.

What to do

• Upgrade dtale past 3.10.0 using the fix commit 32bd6fb4a63de779ff1e51823a456865ea3cbd13 or a later release.
• Replace the hardcoded SECRET_KEY with a unique, randomly generated value per deployment and rotate any existing sessions.
• Disable or restrict the /update-settings endpoint and custom filter functionality until patched.
• Do not expose dtale directly to untrusted networks; place it behind authentication and network controls.
• Monitor for forged session cookies and unexpected code execution on dtale hosts.

Detection

• Inspect Flask session cookies for signatures that validate against the default hardcoded SECRET_KEY.
• Alert on POST requests to /update-settings, especially with custom filter payloads.
• Monitor dtale processes for unexpected child processes or outbound connections indicating code execution.
• Review web logs for authentication bypass patterns such as valid sessions without a prior login.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.