AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2024-1726 | Quarkus RESTEasy: DoS via late-stage auth checks | 5.3 | |
| HIGH | CVE-2026-6639 | AIWU WP Plugin: unauth leak of stored OpenAI keys | 7.5 | |
| HIGH | CVE-2026-71211 | MLflow AI Gateway: SSRF via unvalidated api_base | mlflow | 7.1 |
| CRITICAL | CVE-2026-9205 | Langflow: weak Fernet key derivation exposes secrets | langflow | 9.8 |
| HIGH | CVE-2026-69111 | Milvus: unauthenticated DoS via /management/stop | milvus | 7.5 |
| HIGH | CVE-2026-57819 | Apache CXF: JAX-RS form parameter flood enables DoS | 7.5 | |
| HIGH | CVE-2026-54763 | Traefik: underscore header bypass spoofs identity | github.com/traefik/traefik/v3 | - |
| HIGH | CVE-2026-43632 | llama.cpp: UAF race in tokenize endpoints risks RCE | 8.1 | |
| CRITICAL | CVE-2026-67622 | Flowise: IDOR in Assistants API leaks OpenAI credentials | Flowise | 9.9 |
| HIGH | CVE-2026-18621 | OpenShift AI Pipelines: confused deputy grants node-root | rhaiis/vllm-cpu-rhel9 | 7.6 |
| HIGH | CVE-2026-18947 | Feast: authz bypass in /materialize triggers DoS | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | 8.5 |
| HIGH | CVE-2026-18941 | Feast: no-auth default enables RCE via malicious UDF | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | 7.7 |
| MEDIUM | CVE-2026-14548 | Ray Translation WP: Subscribers can hijack API token | Ray Enterprise Translation | 6.5 |
| HIGH | CVE-2026-48766 | TypeBot: guest role exfiltrates OpenAI keys via SSRF | 7.6 | |
| HIGH | CVE-2026-73079 | Sub2API: path traversal leaks pooled AI credentials | 8.5 | |
| HIGH | CVE-2026-18640 | Velociraptor: path traversal corrupts ACL/hunt metadata | 7.1 | |
| MEDIUM | CVE-2026-48762 | TypeBot: SSRF via audio transcription URL fetch | 5.4 | |
| HIGH | CVE-2026-19594 | snowflake.core: injection enables privilege escalation | 8.1 | |
| MEDIUM | CVE-2026-18663 | 389-ds-base: double-free in LDAP control handling | 5.9 | |
| HIGH | CVE-2026-72789 | SiYuan: broken access control leaks encrypted notes | github.com/siyuan-note/siyuan/kernel | 8.6 |