Authentication Bypass in ai-inference-server by Red Hat
CVE-2025-6920
5.3MEDIUM
What is CVE-2025-6920?
A vulnerability exists in the authentication enforcement mechanism of the ai-inference-server's model inference API, specifically affecting the POST /invocations endpoint. This endpoint lacks proper API key validation, allowing unauthorized users to exploit the flaw. As a result, sensitive functionalities normally protected by API keys may be exposed, granting unintended access to backend resources and inference features. Organizations using this server should immediately assess their security posture and implement necessary measures to mitigate the risk of unauthorized access.