Authentication Bypass in ai-inference-server by Red Hat
CVE-2025-6920

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ai Inference Server
Vendor
CVE Published:
1 July 2025

What is CVE-2025-6920?

A vulnerability exists in the authentication enforcement mechanism of the ai-inference-server's model inference API, specifically affecting the POST /invocations endpoint. This endpoint lacks proper API key validation, allowing unauthorized users to exploit the flaw. As a result, sensitive functionalities normally protected by API keys may be exposed, granting unintended access to backend resources and inference features. Organizations using this server should immediately assess their security posture and implement necessary measures to mitigate the risk of unauthorized access.

References

https://access.redhat.com/security/cve/CVE-2025-6920
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2375522
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.