CVE-2026-65012: InvokeAI Information Disclosure Flaw

CVE-2026-65012 Overview

CVE-2026-65012 is an unauthenticated directory enumeration vulnerability affecting InvokeAI versions before 6.13.7. The flaw resides in the GET /api/v2/models/scan_folder endpoint, which accepts an attacker-controlled scan_path parameter without requiring authentication. Remote attackers can recursively enumerate arbitrary filesystem directories on the server and use HTTP response codes to determine file existence and readability. The vulnerability bypasses the multi-user mode access controls that InvokeAI otherwise enforces. It is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated remote attackers can map server filesystem structure and identify sensitive files, aiding reconnaissance for subsequent attacks against InvokeAI deployments.

Affected Products

InvokeAI versions prior to 6.13.7
InvokeAI deployments operating in multi-user mode
Self-hosted InvokeAI instances exposing the model-manager API

Discovery Timeline

2026-07-22 - CVE-2026-65012 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65012

Vulnerability Analysis

InvokeAI exposes a REST endpoint at GET /api/v2/models/scan_folder intended to enumerate directories containing model files. In versions before 6.13.7, this endpoint did not enforce authentication and accepted a caller-supplied scan_path argument. An attacker can supply arbitrary absolute paths and observe the HTTP status returned by the server. Successful responses reveal that a directory exists and is readable, while error responses distinguish non-existent paths from permission-denied paths. Repeating this process across candidate paths enables recursive enumeration of the underlying filesystem. The behavior violates the isolation expected in multi-user mode, where API callers should be restricted to their own resources.

Root Cause

The root cause is missing authentication on model-manager and app-info API routes. The scan_folder handler processed requests without validating the caller identity or restricting scan_path to a safe root directory. Because InvokeAI's multi-user mode relied on route-level authentication middleware that was not applied to these endpoints, the access-control model was effectively bypassed.

Attack Vector

Exploitation requires only network reachability to the InvokeAI HTTP API. An attacker issues repeated GET /api/v2/models/scan_folder?scan_path=<path> requests with paths of interest such as /etc, /home, /root, or user directories. Response codes indicate whether the target directory exists and is enumerable. No credentials, user interaction, or prior foothold are needed.

python

# Security patch applied in invokeai/app/api/routers/images.py
# fix(api): require auth on model-manager and app-info endpoints (#9365) (#9367)

@images_router.post("/", operation_id="create_image_upload_entry")
async def create_image_upload_entry(
    _: CurrentUserOrDefault,
    width: int = Body(description="The width of the image"),
    height: int = Body(description="The height of the image"),
    board_id: Optional[str] = Body(default=None, description="The board to add this image to, if any"),

Source: GitHub Commit d315b89. The patch introduces a CurrentUserOrDefault dependency, forcing FastAPI to resolve and validate the current user before executing the route handler.

Detection Methods for CVE-2026-65012

Indicators of Compromise

Repeated unauthenticated GET /api/v2/models/scan_folder requests from a single source IP with varying scan_path values.
Web server access logs showing enumeration patterns targeting system paths such as /etc, /root, /home, /var, or Windows path equivalents.
Bursts of 4xx and 2xx responses from the scan_folder endpoint indicating path probing.

Detection Strategies

Deploy web application firewall rules that flag or block requests to /api/v2/models/scan_folder lacking an authenticated session cookie or bearer token.
Alert on any single client issuing more than a small threshold of requests per minute to InvokeAI model-manager endpoints.
Correlate enumeration attempts with subsequent access to sensitive file paths through other InvokeAI endpoints.

Monitoring Recommendations

Enable verbose HTTP access logging on the InvokeAI reverse proxy and forward logs to a central SIEM for analysis.
Monitor egress from the InvokeAI host for unexpected outbound traffic that may follow successful reconnaissance.
Track the InvokeAI application version across all deployments to confirm remediation coverage.

How to Mitigate CVE-2026-65012

Immediate Actions Required

Upgrade InvokeAI to version 6.13.7 or later, which enforces authentication on the affected endpoints.
Restrict network exposure of the InvokeAI API to trusted networks or place it behind an authenticated reverse proxy.
Review access logs for prior unauthenticated calls to /api/v2/models/scan_folder to assess exposure.

Patch Information

The fix is delivered in InvokeAI Release v6.13.7 via commit d315b89. Additional context is available in GitHub Issue #9365, Pull Request #9367, and the VulnCheck Security Advisory. The patch adds a CurrentUserOrDefault dependency across model-manager and app-info routes so that FastAPI resolves an authenticated user before dispatching the handler.

Workarounds

Block the /api/v2/models/scan_folder route at a reverse proxy layer until the upgrade can be applied.
Bind the InvokeAI service to a loopback interface and require an authenticated proxy such as nginx with auth_basic for external access.
Disable multi-user mode temporarily and limit access to trusted operators on isolated networks.

bash

# Example nginx configuration to block the vulnerable endpoint
location /api/v2/models/scan_folder {
    return 403;
}

location /api/ {
    auth_basic "InvokeAI Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:9090;
}