CVE-2026-85668
highXinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint…
Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizer_config.json, and chat_template.jinja files at the supplied path and reflects the parsed content back to the caller, allowing an unauthenticated attacker to probe the server filesystem and extract content of files with those names in any directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/xorbitsai/inference disclosure@vulncheck.com
- https://github.com/xorbitsai/inference/blob/v3.3.0/xinference/model/llm/config_parser.py disclosure@vulncheck.com
- https://github.com/xorbitsai/inference/issues/5176 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/xinference-3.3.0-unauthenticated-arbitrary-path-file-... disclosure@vulncheck.com
- https://github.com/xorbitsai/inference/issues/5176 134c704f-9b21-4f2e-91b3-4a467353bcc0