CVE-2026-85668

Xinference v3.x (including commit 4a94832) exposes an unauthenticated arbitrary-path file read through the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter with no authentication and no confinement to a trusted directory. On each request the server reads and parses config.json, tokenizer_config.json, and chat_template.jinja from the supplied path and reflects the parsed content back to the caller, so an attacker can point model_path at any directory on the host filesystem (CWE-73, external control of file name/path). An unauthenticated attacker gains read access to any file with those three names anywhere on the filesystem; the impact is confidentiality-only (CVSS 4.0: VC:H, VI:N, VA:N), with no file write or code execution. Any network-reachable Xinference deployment running the affected 3.x code is exposed, especially instances whose API port is bound beyond localhost. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates a 0.4% probability of exploitation within 30 days (38th percentile).

What to do: Restrict network access to the Xinference API so that /v1/models/llm/auto-register is reachable only from trusted clients, since the endpoint requires no authentication, and check access logs for unauthenticated POSTs carrying traversal-style model_path values. Apply the official patch or fixed Xinference 3.x release as soon as one is published (the data identifies affected commit 4a94832 but not a fixed version). Note that the attacker can only read files named config.json, tokenizer_config.json, or chat_template.jinja, so prioritize directories where such files could contain sensitive content.