AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-86289 | Ollama: integer overflow in GGUF decoder causes DoS | ollama | 4.3 |
| MEDIUM | CVE-2026-86332 | RHOAI dashboard: broken authz leaks NIM/NGC secrets | rhoai/odh-mod-arch-mlflow-rhel9 | 6.5 |
| HIGH | CVE-2026-84452 | winml-cli: RCE via wildcard CORS + trust-remote-code | winml-cli | - |
| HIGH | CVE-2026-6485 | InsydeH2O UEFI: BIOS Shell allows Secure Boot bypass | InsydeH2O | 8.2 |
| HIGH | CVE-2026-12855 | InsydeH2O: BIOS memory corruption enables local RCE | InsydeH2O | 8.2 |
| HIGH | CVE-2026-59158 | nuxt-ollama: API key leaked in public SSR payload | nuxt-ollama | 7.5 |
| MEDIUM | CVE-2026-87994 | Open WebUI: channel authz gap allows message spoofing | open-webui | 4.3 |
| HIGH | CVE-2026-88009 | Traefik: HTTP routing desync enables auth/log bypass | github.com/traefik/traefik/v2 | - |
| HIGH | GHSA-m3wp-48jr-vr4g | mistral.rs: unbounded media fetch enables DoS | mistralrs-server-core | 7.5 |
| HIGH | GHSA-wfgq-w7cq-qj7j | mistral.rs: SSRF & file-read via image/audio URLs | mistralrs-server-core | 7.2 |
| HIGH | CVE-2026-71416 | Headroom: CSWSH bypass allows unauthenticated LLM abuse | headroom-ai | 8.8 |
| HIGH | CVE-2026-90553 | vLLM: RCE bypasses trust_remote_code model safeguard | vllm | 7.8 |
| HIGH | CVE-2026-90554 | vLLM: audio decode DoS via NanoNemotronVL video input | vllm | 7.5 |
| MEDIUM | CVE-2026-90555 | vLLM: FLAC header spoofing crashes transcription API | vllm | 6.5 |
| LOW | CVE-2026-90713 | vLLM: local DoS via malformed tiktoken vocab file | vllm | 3.3 |
| MEDIUM | CVE-2026-55093 | tract-nnef: integer overflow enables heap OOB read, crash | 6.1 | |
| MEDIUM | CVE-2026-90878 | vLLM: chat_template abuse causes resource exhaustion | vllm | 4.3 |
| MEDIUM | CVE-2026-92220 | vLLM: MoRIIO KV handler flaw allows remote DoS | vllm | 5.3 |
| CRITICAL | CVE-2025-59953 | LMDeploy: unsafe pickle deserialization allows RCE | lmdeploy | 9.8 |
| MEDIUM | CVE-2026-92365 | vLLM: algorithmic complexity DoS in thinking budget | vllm | 4.3 |