CVE-2026-76841: Xinference RCE Vulnerability

CVE-2026-76841 Overview

CVE-2026-76841 is a remote code execution vulnerability in Xinference, an open-source inference server maintained by the Xorbits project. Versions before 2.12.0 hardcode trust_remote_code=True across six model loader call sites and expose no setting to disable it. A caller with model launch access can register a model of unknown type and supply an arbitrary model path. The server then invokes AutoTokenizer.from_pretrained, which imports and executes Python declared by the attacker-controlled tokenizer_config.jsonauto_map. The result is arbitrary code execution with the privileges of the worker process. The issue is classified as CWE-94 Improper Control of Generation of Code.

Critical Impact

Authenticated callers with model launch permission can achieve remote code execution on Xinference workers by pointing loaders at a malicious model directory.

Affected Products

• Xinference (xorbitsai/inference) versions prior to 2.12.0
• xinference/model/rerank/core.py and xinference/model/rerank/sentence_transformers/core.py
• xinference/model/embedding/sentence_transformers/core.py, xinference/model/embedding/flag/core.py, and xinference/model/llm/transformers/core.py

Discovery Timeline

• 2026-08-24 - CVE-2026-76841 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76841

Vulnerability Analysis

Xinference loads Hugging Face models through several loader classes that wrap transformers and sentence-transformers APIs. In versions before 2.12.0, six call sites pass trust_remote_code=True unconditionally: RerankModel._get_tokenizer, SentenceTransformerRerankModel.load, SentenceTransformerEmbeddingModel.load, FlagEmbeddingModel.load, and two sites in xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components default the value to True.

Hugging Face's trust_remote_code flag opts into executing Python shipped alongside a model. When enabled, loaders honor the auto_map entries in tokenizer_config.json and config.json, importing modules from the model directory. Xinference's API allows a caller to register a model whose type is unknown and to supply an arbitrary model path.

Root Cause

The root cause is a hardcoded insecure default. The loaders never expose a configuration surface to disable remote code execution, and _auto_detect_type forwards attacker-controlled paths straight into AutoTokenizer.from_pretrained. Because untrusted model directories are treated as if they were vetted first-party artifacts, the trust boundary between model metadata and executable code collapses.

Attack Vector

An attacker with model launch access stages a malicious model directory containing a tokenizer_config.json whose auto_map references a Python module in the same directory. The attacker calls the Xinference launch endpoint with the crafted model path and an unknown model type. During loading, transformers imports the referenced module and runs its top-level statements. The payload executes in the worker process context with full access to loaded weights, mounted volumes, environment variables, and outbound network reachability. See the VulnCheck advisory and GitHub Issue #5023 for the reference chain.

Detection Methods for CVE-2026-76841

Indicators of Compromise

• Unexpected child processes spawned by the Xinference worker during model load, especially python, shell interpreters, or outbound network utilities.
• Model directories containing tokenizer_config.json or config.json with auto_map pointing to local .py files not shipped with a known Hugging Face repository.
• Model launch API calls submitting unknown model_type values with attacker-controlled model_path parameters.

Detection Strategies

• Monitor calls to AutoTokenizer.from_pretrained and AutoModel.from_pretrained where trust_remote_code=True is used against non-bundled model paths.
• Alert on file writes under model cache directories that create Python files adjacent to tokenizer_config.json.
• Baseline Xinference worker syscall behavior and flag execve, connect, or credential access originating from loader threads.

Monitoring Recommendations

• Ship Xinference API access logs and worker process telemetry into a centralized analytics platform for correlation with model registration events.
• Track version fingerprints of deployed Xinference instances and alert when workers running versions below 2.12.0 remain reachable.
• Review model registry contents on a schedule to confirm only vetted, bundled built-in models are configured.

How to Mitigate CVE-2026-76841

Immediate Actions Required

• Upgrade Xinference to version 2.12.0 or later, which gates every loader behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting.
• Restrict model launch permissions to a minimal set of trusted operators and rotate any API tokens exposed to untrusted users.
• Audit the model registry and remove any custom model paths that were introduced by non-administrative accounts.

Patch Information

The fix landed in Pull Request #5027 and shipped in Xinference 2.12.0. Every loader site now consults allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE environment variable, permitting remote code execution only for bundled built-in models. Deployment details are available at the Xinference GitHub repository.

Workarounds

• If upgrading is not immediately feasible, place Xinference workers on isolated network segments with no outbound internet access and no sensitive credentials in the process environment.
• Restrict authenticated access to the Xinference control plane behind an authenticating reverse proxy and disable model launch for shared or low-trust users.
• Enforce read-only, pre-vetted model cache directories and block worker processes from writing new .py files at runtime using mandatory access control policies.

# Configuration example: upgrade and enforce trust_remote_code gating in 2.12.0+
pip install --upgrade "xinference>=2.12.0"

# Leave XINFERENCE_TRUST_REMOTE_CODE unset (default) to block remote code
# execution for non-bundled models. Only set to 1 in fully trusted lab setups.
unset XINFERENCE_TRUST_REMOTE_CODE

# Start the server
xinference-local --host 127.0.0.1 --port 9997