Michael-A-Kuykendall Shimmy: Missing authentication in Inference API (CVE-2026-125087)
The Michael-A-Kuykendall Shimmy Inference API contains a missing authentication vulnerability in src/server.rs that permits unauthenticated remote access, resolved in version 2.6.5.
CVE search metadata
CVE search record: CVE-2026-125087. Severity: high. CVSS: 7.3. KEV: no. Product: Shimmy (<= 2.6.4). Brief: Michael-A-Kuykendall Shimmy: Missing authentication in Inference API (CVE-2026-125087). Brief link: https://feed.craftedsignal.io/briefs/2026-11-shimmy-auth-bypass/
Triage facts
Revision 1- Applicability
- Shimmy (<= 2.6.4)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 02:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A missing authentication vulnerability exists in the Michael-A-Kuykendall Shimmy component, specifically within the Inference API's handling of requests in the src/server.rs file. This vulnerability allows an unauthenticated remote attacker to interact with the API functions. This flaw affects versions up to 2.6.4. The issue is addressed in version 2.6.5.
Impact
Successful exploitation allows for unauthenticated remote interaction with the Inference API, which may lead to unauthorized data access or service manipulation depending on the API's function capabilities.
Recommendation
- Upgrade Shimmy to version 2.6.5 or later immediately.
- Audit logs for unauthorized access patterns to the Inference API endpoints.
- Implement network-level access controls to restrict exposure of the Inference API to authorized clients only.
Immediate actions
Upgrade Shimmy to version 2.6.5 or later
Threat Hunt
Monitor web server access logs for anomalous, unauthenticated requests to the Inference API
Data: Web server access logs (HTTP status codes, request paths)
Mitigations
Upgrade to Shimmy 2.6.5
CVE-2026-125087