AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| HIGH | CVE-2026-94627 | vLLM: Mooncake KV cache leak enables GPU DoS | vllm | 7.5 |
| HIGH | CVE-2026-56676 | 9router: DNS rebinding SSRF in image prefetch | 9router | 7.4 |
| CRITICAL | CVE-2026-61732 | Decepticon: ChatML token injection yields sandbox RCE | decepticon-sdk | 10.0 |
| HIGH | CVE-2026-89032 | LiteLLM: semantic cache tenant bypass leaks data | litellm | 7.7 |
| MEDIUM | CVE-2026-100653 | vLLM: revision pin bypass loads unpinned HF artifacts | vllm | 6.5 |
| HIGH | CVE-2026-100647 | vLLM: unbounded cache_salt allows unauthenticated DoS | vllm | 7.5 |
| MEDIUM | CVE-2026-100648 | vLLM: audio size limit bypass enables resource exhaustion | vllm | 5.3 |
| MEDIUM | CVE-2026-100649 | vLLM: sampler subclass bypass exhausts GPU memory | vllm | 5.3 |
| MEDIUM | CVE-2026-100650 | vLLM: unbounded media fetch enables pre-inference DoS | vllm | 6.5 |
| MEDIUM | CVE-2026-100651 | vLLM: prompt-length bypass on disagg endpoint causes DoS | vllm | 6.5 |
| HIGH | CVE-2026-100652 | vLLM: invalid stop_token_ids crash EngineCore (DoS) | vllm | 7.5 |
| MEDIUM | CVE-2026-100654 | vLLM: out-of-range stop_token_ids crash EngineCore (DoS) | vllm | 6.5 |
| HIGH | GHSA-456v-xq2p-r4cj | code-ollama: shell injection in grep_search allows RCE | ollama | 7.8 |
| HIGH | CVE-2026-93355 | LiteLLM: JWT email fallback enables admin account takeover | litellm | 8.1 |
| HIGH | CVE-2026-102697 | Ollama: agent Bash approval bypass via shell operators | ollama | 7.8 |
| HIGH | CVE-2026-103241 | vLLM: Gemma4 parser flaw allows remote DoS | vllm | 7.5 |
| MEDIUM | CVE-2026-15588 | GLib GDBus: unbounded auth line enables local DoS | rhaiis/vllm-cuda-rhel9 | 5.3 |
| MEDIUM | CVE-2026-58010 | GLib: off-by-one read in GVariant causes DoS | rhaiis/vllm-cuda-rhel9 | 6.5 |
| MEDIUM | CVE-2026-58013 | GLib: buffer over-read in line reader causes DoS | rhaiis/vllm-cuda-rhel9 | 6.5 |
| MEDIUM | CVE-2026-58012 | GLib: g_regex_replace RAW over-read leaks bytes, DoS | rhaiis/vllm-cuda-rhel9 | 6.5 |