AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-28707 | LLM-on-Ray: local privilege escalation flaw | LLM-on-Ray | - |
| HIGH | CVE-2026-6484 | InsydeH2O UEFI: unverified boot allows local code execution | InsydeH2O | 8.2 |
| MEDIUM | CVE-2026-73555 | vLLM: verbose errors leak host paths & usernames | vllm | 5.3 |
| MEDIUM | CVE-2026-73556 | vLLM: ReDoS in structured output stalls engine | vllm | 5.3 |
| MEDIUM | CVE-2026-73557 | vLLM: race condition bypasses prompt-embeds tensor guard | vllm | - |
| MEDIUM | CVE-2026-73558 | vLLM: integer overflow leaks other users' output | vllm | 5.3 |
| MEDIUM | CVE-2026-73559 | vLLM: unbounded prompt batch triggers single-request DoS | vllm | 6.5 |
| MEDIUM | CVE-2026-71486 | vLLM: unbounded /derender inputs cause resource DoS | vllm | 4.3 |
| MEDIUM | CVE-2026-73560 | vLLM: SSRF/LFI bypass in MiMo-V2 multimodal input | vllm | 6.5 |
| MEDIUM | GHSA-mpwr-8vm7-h73f | go-pkcs12: PBMAC1 flaw lets wrong-password files decode | software.sslmate.com/src/go-pkcs12 | - |
| MEDIUM | CVE-2026-75093 | tract: malformed ONNX model triggers buffer flaw | 4.3 | |
| MEDIUM | CVE-2026-8810 | InsydeH2O: UEFI variable flaw exposes HDD password | InsydeH2O, InsydeH2O ARM | 6.9 |
| CRITICAL | CVE-2026-76850 | LMDeploy: RCE via unauth pickle deserialization | lmdeploy | 9.8 |
| HIGH | CVE-2026-77775 | Headroom: SSRF via client-set upstream base URL | 8.6 | |
| CRITICAL | CVE-2026-61539 | Xinference: eval() on LLM output enables RCE | xinference | 10.0 |
| MEDIUM | CVE-2026-45271 | Picotls: unbounded ASN.1 recursion crashes on malicious key | picotls | 5.5 |
| MEDIUM | CVE-2026-78205 | BentoML: SSRF via unfiltered CGNAT range | bentoml | 5.8 |
| HIGH | CVE-2026-76841 | Xinference: RCE via forced trust_remote_code=True | 8.8 | |
| MEDIUM | CVE-2026-78684 | vLLM: unauthenticated DoS via DeepStream decode bypass | vllm | 5.3 |
| HIGH | CVE-2026-79784 | Vocos: RCE via unrestricted class loading in model config | 8.8 |