AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| HIGH | CVE-2026-85666 | OGX/Llama Stack: SSRF via MCP tool server_url | llama-stack | 7.5 |
| HIGH | CVE-2026-85673 | LLaMA-Factory: SSRF guard bypass via redirect/DNS rebind | llama-factory | 7.5 |
| HIGH | CVE-2026-85686 | ms-swift: unauth SSRF via multimodal media URLs | ms-swift | 7.5 |
| HIGH | CVE-2026-72794 | SiYuan: CookieKey leak enables session forgery | github.com/siyuan-note/siyuan/kernel | 8.6 |
| MEDIUM | CVE-2026-86332 | RHOAI dashboard: broken authz leaks NIM/NGC secrets | rhoai/odh-mod-arch-mlflow-rhel9 | 6.5 |
| MEDIUM | CVE-2026-86073 | n8n: OAuth refresh token skips workflow-resource binding | n8n | - |
| HIGH | CVE-2026-86082 | n8n: OpenAI node leaks API key via SSRF bypass | n8n | - |
| HIGH | CVE-2026-86075 | n8n: unauth OAuth DCR fields exhaust DB storage | n8n | - |
| MEDIUM | CVE-2026-87820 | CyberPanel: AI Scanner endpoints leak admin usernames unauthenticated | 5.3 | |
| HIGH | CVE-2026-59158 | nuxt-ollama: API key leaked in public SSR payload | nuxt-ollama | 7.5 |
| MEDIUM | CVE-2026-87013 | Open WebUI: authenticated DoS via folder cycle | open-webui | 4.3 |
| HIGH | CVE-2026-87011 | Open WebUI: unauth DoS via OIDC logout handler | open-webui | 7.5 |
| MEDIUM | CVE-2026-87015 | Open WebUI: session cookies leak to rogue tool server | open-webui | 6.8 |
| HIGH | CVE-2026-87016 | Open WebUI: OAuth wildcard bug hijacks admin sessions | open-webui | 8.1 |
| MEDIUM | CVE-2026-87997 | Open WebUI: folder auth bypass injects rogue chats | open-webui | 4.3 |
| HIGH | CVE-2026-87998 | Open WebUI: authZ flaw lets users kill shared KB configs | open-webui | 7.1 |
| MEDIUM | CVE-2026-88005 | Open WebUI: OAuth token exchange bypasses domain allowlist | open-webui | 6.5 |
| HIGH | CVE-2026-88009 | Traefik: HTTP routing desync enables auth/log bypass | github.com/traefik/traefik/v2 | - |
| HIGH | GHSA-m3wp-48jr-vr4g | mistral.rs: unbounded media fetch enables DoS | mistralrs-server-core | 7.5 |
| HIGH | GHSA-wfgq-w7cq-qj7j | mistral.rs: SSRF & file-read via image/audio URLs | mistralrs-server-core | 7.2 |