CVE-2026-85668: Xinference Path Traversal Vulnerability

CVE-2026-85668 Overview

CVE-2026-85668 is an unauthenticated arbitrary-path file read vulnerability in Xinference, affecting commit 4a94832 and version 3.x releases. The flaw resides in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizer_config.json, and chat_template.jinja files at the supplied path, then reflects parsed content back to the caller. An unauthenticated remote attacker can enumerate directories and extract the contents of any file matching those names on the server filesystem.

Critical Impact
Remote unauthenticated attackers can probe arbitrary server paths and exfiltrate configuration or template files, exposing model deployments and sensitive host data.

Affected Products

Xinference commit 4a94832
Xinference v3.x releases including v3.3.0
Deployments exposing the /v1/models/llm/auto-register endpoint

Discovery Timeline

2026-09-04 - CVE-2026-85668 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85668

Vulnerability Analysis

Xinference exposes an HTTP endpoint at POST /v1/models/llm/auto-register designed to register large language models by pointing the server at a local model directory. The handler trusts the model_path value supplied in the request body and passes it directly to the configuration parser. The parser opens config.json, tokenizer_config.json, and chat_template.jinja from that path and returns parsed content in the HTTP response.

The endpoint enforces no authentication, no session context, and no path validation. An attacker on the network can supply any absolute or relative path and cause the server to read files it has permission to access. Reflected file content enables reconnaissance of internal model artifacts, tokenizer templates, and any configuration file matching the expected filenames. The issue is classified under CWE-73: External Control of File Name or Path.

Root Cause

The root cause is missing authentication combined with absent path confinement in the auto-registration handler. The config_parser.py logic used by the endpoint does not restrict model_path to an approved model root directory or normalize the path against traversal. See the LLM Config Parser source for the vulnerable parsing logic.

Attack Vector

Exploitation requires only network reachability to the Xinference API. An attacker sends a crafted POST request supplying model_path values pointing to directories of interest such as system configuration paths, container secrets mounts, or application data directories. The server returns parsed JSON or Jinja template contents for any file matching the three probed filenames. Repeated requests enable directory enumeration and content harvesting. Refer to the VulnCheck Advisory and GitHub Issue #5176 for reported details.

Detection Methods for CVE-2026-85668

Indicators of Compromise

HTTP POST requests to /v1/models/llm/auto-register from unexpected source addresses or without prior authenticated session activity.
Request bodies containing model_path values referencing paths outside the intended model storage directory, such as /etc, /root, /proc, or container secret mount points.
Response payloads reflecting the contents of config.json, tokenizer_config.json, or chat_template.jinja files not associated with registered models.

Detection Strategies

Inspect reverse proxy and application logs for POST calls to the auto-register endpoint and alert on values of model_path that resolve outside the sanctioned model root.
Correlate high-volume auto-register requests from a single source as filesystem enumeration behavior.
Deploy web application firewall rules that block or challenge unauthenticated requests to /v1/models/llm/.

Monitoring Recommendations

Baseline legitimate model registration flows and alert on deviations in request source, frequency, or path structure.
Forward Xinference application and access logs to a centralized analytics platform for retention and query.
Monitor egress connections from the Xinference host for anomalous data movement following auto-register activity.

How to Mitigate CVE-2026-85668

Immediate Actions Required

Restrict network access to the Xinference API so it is not reachable from untrusted networks or the public internet.
Place the service behind an authenticating reverse proxy that requires credentials before requests reach /v1/models/llm/auto-register.
Audit application logs for prior exploitation attempts targeting the auto-register endpoint.

Patch Information

At the time of publication no fixed release is referenced in the NVD entry. Monitor the Xinference GitHub repository and Issue #5176 for a vendor patch and upgrade guidance. Apply the fixed version as soon as it becomes available.

Workarounds

Block or filter requests to /v1/models/llm/auto-register at the network edge until a patch is deployed.
Run Xinference under a least-privilege service account so filesystem reads are constrained to the model directory only.
Isolate the Xinference process in a container with read-only mounts limited to the sanctioned model root.
Enforce authentication and authorization at an API gateway in front of the service.

bash

# Example NGINX snippet to block unauthenticated access to the vulnerable endpoint
location = /v1/models/llm/auto-register {
    deny all;
    return 403;
}