AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | GHSA-g4qm-m288-5cp9 | Coraza WAF: cookie parser mismatch enables WAF bypass | github.com/corazawaf/coraza/v3 | 4.0 |
| MEDIUM | GHSA-x26q-wvhg-fh4m | Coraza WAF: malformed URI bypasses GET arg inspection | github.com/corazawaf/coraza/v3 | 4.0 |
| MEDIUM | CVE-2026-104774 | Coraza WAF: octal jsDecode bug lets payloads bypass rules | github.com/corazawaf/coraza/v3 | 5.8 |
| HIGH | GHSA-6gcq-wc29-5xf2 | Coraza WAF: stack overflow DoS via JSON body | github.com/corazawaf/coraza/v3 | 7.5 |
| MEDIUM | GHSA-5gj4-9gm7-2fx2 | Coraza WAF: JSON key collision bypasses inspection | github.com/corazawaf/coraza/v3 | 5.8 |
| UNKNOWN | CVE-2026-101998 | Docker Sandboxes: fail-open proxy leaks OAuth and API tokens | anthropic | - |
| HIGH | CVE-2026-100227 | Apache CXF: XML signature wrapping bypass in JAX-RS | 7.5 | |
| UNKNOWN | CVE-2026-107852 | Jexactyl: Stripe payment validation bypass allows underpayment | - | |
| MEDIUM | CVE-2026-108554 | pdf2zh: unauthenticated SSRF via Link input | pdf2zh | 5.3 |
| MEDIUM | CVE-2026-108597 | Cohere SDK: tar slip in SageMaker S3 model extraction | cohere | 4.8 |
| MEDIUM | CVE-2026-108574 | LiteLLM: IDOR in spend logs exposes session data | LiteLLM | 4.3 |
| MEDIUM | CVE-2026-108575 | LiteLLM: improper authorization in get_secret api_key | LiteLLM | 6.3 |
| HIGH | CVE-2026-108836 | Ollama: SSRF via model name validation in Pull API | ollama | 7.3 |
| MEDIUM | CVE-2026-109292 | Open WebUI: session cookie leak to OAuth connections | open-webui | 6.8 |
| MEDIUM | CVE-2026-109296 | Open WebUI: missing authz exposes disabled backends | open-webui | 4.3 |
| MEDIUM | CVE-2026-109311 | vLLM: heap overflow DoS via IAMF audio upload | vllm | 6.5 |
| MEDIUM | CVE-2026-109284 | Open WebUI: chat fork lacks folder write check | open-webui | 4.3 |
| HIGH | CVE-2026-109286 | Open WebUI: session token theft via SyncStatsModal | open-webui | 8.1 |
| MEDIUM | CVE-2026-109283 | Open WebUI: OAuth token exchange retains stale role | open-webui | 5.4 |
| MEDIUM | CVE-2026-109294 | Open WebUI: gzip bomb via image URL causes DoS | open-webui | 6.5 |