Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85668Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

High 7.5

In plain English

A high-severity security flaw in inference from xorbitsai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizer_config.json, and chat_template.jinja files at the supplied path and reflects the parsed content back to the caller, allowing an unauthenticated attacker to probe the server filesystem and extract content of files with those names in any directory.

Affected products (as reported)

Vendor	Product	Versions
xorbitsai	inference	0 – through 3.3.0

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #5176 issue-tracking
https://github.com/xorbitsai/inference product
https://github.com/xorbitsai/inference/blob/v3.3.0/xinference/model/llm/config_parser.py technical-description
VulnCheck Advisory: Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register third-party-advisory