Unauthenticated Arbitrary File Read in Xinference

Xinference, an open-source model serving framework, is affected by a critical arbitrary file read vulnerability (CVE-2026-85668) within its model registration mechanism. The vulnerability exists in the POST /v1/models/llm/auto-register endpoint, which fails to enforce authentication or restrict file paths provided in the model_path parameter. When a user provides a path, the application attempts to locate and parse config.json, tokenizer_config.json, and chat_template.jinja files within that directory. Because these contents are reflected back in the API response, an unauthenticated attacker can supply arbitrary filesystem paths to read sensitive configuration files or other data stored in locations where these specific filenames exist. This issue affects Xinference version 3.x and commit 4a94832. Successful exploitation allows unauthorized information disclosure, potentially exposing system credentials, environment variables, or other sensitive configuration parameters to remote attackers.

Impact

The vulnerability poses a high risk to deployments of Xinference, as it permits unauthenticated remote attackers to enumerate files and exfiltrate content from the host server. Depending on the environment, this could lead to the exposure of API keys, database credentials, or internal service configurations, facilitating further compromise of the infrastructure.

Recommendation

• Upgrade Xinference to a version that implements proper input validation and path sanitization for the model registration process.
• Implement network-level access controls to ensure the Xinference API endpoint is not exposed to the public internet.
• Audit logs for the POST /v1/models/llm/auto-register endpoint to detect anomalous model_path inputs containing path traversal sequences (e.g., ../).
• Configure the Xinference service to run with the least privilege necessary, limiting the filesystem paths the application process can access.