AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-79785 | X-AnyLabeling: MITM model swap yields RCE via torch.load | 5.9 | |
| LOW | CVE-2026-9805 | InsydeH2O: SMM buffer overflow in IHISI FMTS handler | InsydeH2O | 2.7 |
| HIGH | CVE-2026-61617 | Pterodactyl Wings: SFTP quota bypass causes node-wide DoS | 7.7 | |
| UNKNOWN | CVE-2026-65956 | KubePi: exposed SSO config API enables takeover | - | |
| UNKNOWN | CVE-2026-69129 | KubePi: broken cluster-scope check exposes MLOps clusters | - | |
| HIGH | CVE-2026-47852 | Spring AI: predictable ONNX cache path enables model swap | 7.5 | |
| CRITICAL | CVE-2026-37004 | LiteLLM: unauth SSTI in /prompts/test enables RCE | litellm | 9.8 |
| MEDIUM | CVE-2026-18393 | FFmpeg: heap overflow via crafted TDSC cursor in video | rhoai/odh-vllm-gaudi-rhel9 | 5.4 |
| HIGH | CVE-2026-37237 | vLLM: unbounded media URLs cause memory-exhaustion DoS | vllm | 7.5 |
| HIGH | CVE-2026-55638 | 9router: /codex bypass exposes LLM proxy credentials | 9router | 8.6 |
| HIGH | CVE-2026-82288 | SD WebUI: cmd-flags endpoint leaks creds cleartext | 7.5 | |
| MEDIUM | CVE-2026-84377 | LiteLLM: param injection leaks provider API keys | litellm | 6.5 |
| HIGH | CVE-2021-38489 | InsydeH2O UEFI: HDD password stored in plaintext | InsydeH2O | 8.2 |
| MEDIUM | CVE-2021-43613 | InsydeH2O UEFI: password hashes exposed, privesc risk | InsydeH2O | 6.5 |
| MEDIUM | CVE-2021-43614 | InsydeH2O UEFI: buffer overflow in PlatformLangCodes var | InsydeH2O | 6.7 |
| HIGH | CVE-2026-85180 | Ollama: SSRF via unvalidated model-pull redirects | ollama | 7.5 |
| HIGH | CVE-2026-85673 | LLaMA-Factory: SSRF guard bypass via redirect/DNS rebind | llama-factory | 7.5 |
| HIGH | CVE-2026-85686 | ms-swift: unauth SSRF via multimodal media URLs | ms-swift | 7.5 |
| MEDIUM | CVE-2026-85670 | tokenizers: malformed vocab crashes process (DoS) | tokenizers | 6.5 |
| HIGH | CVE-2026-75914 | CodeWhale: symlink traversal leaks files via vision API | codewhale | 7.5 |