Cpe:2.3:a:xorbits:xinference:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3axorbitsxinference/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 15:29:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated Arbitrary File Read in Xinferencehttps://feed.craftedsignal.io/briefs/2026-09-xinference-file-read/Fri, 04 Sep 2026 15:29:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-xinference-file-read/Xinference versions 3.x and commit 4a94832 contain an unauthenticated arbitrary file read vulnerability via the model_path parameter in the auto-register endpoint.Xinference, an open-source model serving framework, is affected by a critical arbitrary file read vulnerability (CVE-2026-85668) within its model registration mechanism. The vulnerability exists in the POST /v1/models/llm/auto-register endpoint, which fails to enforce authentication or restrict file paths provided in the model_path parameter. When a user provides a path, the application attempts to locate and parse config.json, tokenizer_config.json, and chat_template.jinja files within that directory. Because these contents are reflected back in the API response, an unauthenticated attacker can supply arbitrary filesystem paths to read sensitive configuration files or other data stored in locations where these specific filenames exist. This issue affects Xinference version 3.x and commit 4a94832. Successful exploitation allows unauthorized information disclosure, potentially exposing system credentials, environment variables, or other sensitive configuration parameters to remote attackers.

Impact

The vulnerability poses a high risk to deployments of Xinference, as it permits unauthenticated remote attackers to enumerate files and exfiltrate content from the host server. Depending on the environment, this could lead to the exposure of API keys, database credentials, or internal service configurations, facilitating further compromise of the infrastructure.

Recommendation

  • Upgrade Xinference to a version that implements proper input validation and path sanitization for the model registration process.
  • Implement network-level access controls to ensure the Xinference API endpoint is not exposed to the public internet.
  • Audit logs for the POST /v1/models/llm/auto-register endpoint to detect anomalous model_path inputs containing path traversal sequences (e.g., ../).
  • Configure the Xinference service to run with the least privilege necessary, limiting the filesystem paths the application process can access.
]]>highadvisoryvulnerabilityfile-readwebserver