CVE-2026-85668: Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register
Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizerconfig.json, and chattemplate.jinja files at the supplied path and reflects the parsed content back to the caller, allowing an unauthenticated attacker to probe the server filesystem and extract content of files with those names in any directory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Xinference v3.x deployments containing affected commit 4a94832 are exposed if the POST /v1/models/llm/auto-register endpoint is reachable by an attacker. Authentication is not required for exploitation.
What does an attacker need to exploit this issue?
An attacker only needs network access to the vulnerable endpoint and the ability to submit a caller-controlled model_path value. No credentials or user interaction are required.
What information can be read?
The endpoint reads and parses config.json, tokenizer_config.json, and chat_template.jinja at the supplied path, then reflects parsed content to the caller. An attacker can use this to probe directories and extract content from files with those names.
What can be done if patching is not immediately possible?
Restrict access to the POST /v1/models/llm/auto-register endpoint so untrusted users cannot reach it. This is particularly important where the Xinference service is network-accessible.