CVE-2026-85668 Details
Description
Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizer_config.json, and chat_template.jinja files at the supplied path and reflects the parsed content back to the caller, allowing an unauthenticated attacker to probe the server filesystem and extract content of files with those names in any directory.
A vulnerability allowing unauthenticated arbitrary-path file reading has been identified in Xinference version 3.3.0, specifically in the POST /v1/models/llm/auto-register endpoint. This endpoint accepts a user-supplied model_path parameter without authentication or path restrictions. It reads and parses config.json, tokenizer_config.json, and chat_template.jinja files from the specified path, reflecting the parsed content back to the caller. This behavior enables an unauthenticated attacker to probe the server's filesystem and extract information from these files, regardless of their location.
It is recommended to require authentication for the auto-register endpoint, implement path confinement to prevent directory traversal attacks, and allowlist flexible launchers instead of permitting arbitrary module imports.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xorbitsai/inference/issues/5176 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/xorbitsai/inference | [email protected] | Source CodeVendor |
| https://github.com/xorbitsai/inference/blob/v3.3.0/xinference/model/llm/config_parser.py | [email protected] | Source CodeVendor |
| https://github.com/xorbitsai/inference/issues/5176 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/xinference-3.3.0-unauthenticated-arbitrary-path-file-read-via-v1-models-llm-auto-register | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Xorbitsai Xinference | <= 3.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |