CVE-2026-65012: InvokeAI unauthenticated directory

CISO Take

InvokeAI's model-scanning endpoint accepts an attacker-controlled folder path without requiring authentication, letting anyone on the network recursively probe the server's filesystem and use HTTP response codes to infer which files and directories exist and are readable, even when multi-user mode is enabled. There's no EPSS score yet since this is a fresh disclosure, it isn't in CISA KEV, and no public exploit or scanner template exists today, but the bar to exploit is trivial: it's an unauthenticated GET request with a path parameter, requiring no AI or ML expertise. The direct impact is information disclosure, not code execution, but a self-hosted InvokeAI instance is often deployed alongside credential files, SSH keys, or model artifacts on the same host, so a successful enumeration can hand an attacker a map for follow-on attacks. Upgrade to InvokeAI 6.13.7 or later immediately; until then, restrict network access to the InvokeAI API to trusted hosts/VPN only and monitor access logs for repeated scan_folder requests with anomalous or traversal-style path parameters (e.g., `../`, absolute system paths).

Sources: NVD GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium severity (CVSS 5.3) reflecting a confidentiality-only impact with no integrity or availability loss. Exploitability is high in principle — network-reachable, no privileges or user interaction, low complexity — but the practical damage is limited to filesystem existence/readability disclosure rather than direct data exfiltration or execution. Real-world risk depends heavily on exposure: instances bound to 0.0.0.0 or exposed via reverse proxy without network controls are meaningfully at risk of reconnaissance that feeds a larger attack chain; instances kept on isolated internal networks see minimal practical risk.

How does the attack unfold?

Discovery

Attacker identifies an unauthenticated, internet-reachable InvokeAI instance and its scan_folder API endpoint.

AML.T0049

Enumeration

Attacker sends repeated requests with varied scan_path values, using HTTP response codes to infer directory and file existence/readability.

AML.T0037

Reconnaissance impact

Attacker builds a map of the server's filesystem, potentially locating AI model artifacts, config files, or credentials to enable a follow-on attack.

AML.T0007

Discovery

Attacker identifies an unauthenticated, internet-reachable InvokeAI instance and its scan_folder API endpoint.

AML.T0049

Enumeration

Attacker sends repeated requests with varied scan_path values, using HTTP response codes to infer directory and file existence/readability.

AML.T0037

Reconnaissance impact

Attacker builds a map of the server's filesystem, potentially locating AI model artifacts, config files, or credentials to enable a follow-on attack.

AML.T0007

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
InvokeAI	pip	—	No patch
28.2K Pushed 6d ago 50% patched ~92d to patch Full package profile →

Do you use InvokeAI? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

1) Upgrade to InvokeAI 6.13.7 or later, which fixes the authentication gap on the scan_folder endpoint (see the linked commit and release notes). 2) Until patched, do not expose the InvokeAI API directly to the internet — place it behind a VPN, firewall allowlist, or reverse-proxy authentication layer. 3) Audit deployment configuration to confirm multi-user mode is not being relied upon as the sole control for this endpoint. 4) Review access logs for GET requests to /api/v2/models/scan_folder with unusual scan_path values (system paths, traversal sequences, or high-frequency sequential probing) as an indicator of prior exploitation attempts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage API Framework AML.T0007 - Discover AI Artifacts AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

Frequently Asked Questions

What is CVE-2026-65012?

InvokeAI's model-scanning endpoint accepts an attacker-controlled folder path without requiring authentication, letting anyone on the network recursively probe the server's filesystem and use HTTP response codes to infer which files and directories exist and are readable, even when multi-user mode is enabled. There's no EPSS score yet since this is a fresh disclosure, it isn't in CISA KEV, and no public exploit or scanner template exists today, but the bar to exploit is trivial: it's an unauthenticated GET request with a path parameter, requiring no AI or ML expertise. The direct impact is information disclosure, not code execution, but a self-hosted InvokeAI instance is often deployed alongside credential files, SSH keys, or model artifacts on the same host, so a successful enumeration can hand an attacker a map for follow-on attacks. Upgrade to InvokeAI 6.13.7 or later immediately; until then, restrict network access to the InvokeAI API to trusted hosts/VPN only and monitor access logs for repeated scan_folder requests with anomalous or traversal-style path parameters (e.g., `../`, absolute system paths).

Is CVE-2026-65012 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-65012, increasing the risk of exploitation.

How to fix CVE-2026-65012?

1) Upgrade to InvokeAI 6.13.7 or later, which fixes the authentication gap on the scan_folder endpoint (see the linked commit and release notes). 2) Until patched, do not expose the InvokeAI API directly to the internet — place it behind a VPN, firewall allowlist, or reverse-proxy authentication layer. 3) Audit deployment configuration to confirm multi-user mode is not being relied upon as the sole control for this endpoint. 4) Review access logs for GET requests to /api/v2/models/scan_folder with unusual scan_path values (system paths, traversal sequences, or high-frequency sequential probing) as an indicator of prior exploitation attempts.

What systems are affected by CVE-2026-65012?

This vulnerability affects the following AI/ML architecture patterns: model serving, self-hosted generative AI UIs, on-prem ML deployments.

What is the CVSS score for CVE-2026-65012?

CVE-2026-65012 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

model servingself-hosted generative AI UIson-prem ML deployments

MITRE ATLAS Techniques

AML.T0007 Discover AI Artifacts

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.

Exploitation Scenario

An attacker discovers an internet-facing InvokeAI instance (e.g., via Shodan/Censys fingerprinting of the InvokeAI UI or API banner). Without authenticating, they send repeated GET requests to /api/v2/models/scan_folder, varying the scan_path parameter across common system directories (/etc, /home, /root, application config directories). By observing which requests return successful scan results versus errors, the attacker builds a map of the server's directory structure and identifies readable files and folders, including potential configuration files, credential stores, or model storage locations. This reconnaissance data is then used to plan a targeted follow-on attack, such as locating a misconfigured secrets file or another vulnerable service co-located on the host.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.