Authentication Bypass in ai-inference-server by Red Hat

CVE-2025-6920

What is CVE-2025-6920?

A vulnerability exists in the authentication enforcement mechanism of the ai-inference-server's model inference API, specifically affecting the POST /invocations endpoint. This endpoint lacks proper API key validation, allowing unauthorized users to exploit the flaw. As a result, sensitive functionalities normally protected by API keys may be exposed, granting unintended access to backend resources and inference features. Organizations using this server should immediately assess their security posture and implement necessary measures to mitigate the risk of unauthorized access.

References