Missing Authentication in Michael-A-Kuykendall Shimmy Inference API
CVE-2026-125087

6.9MEDIUM

Key Information:

Vendor

Michael-a-kuykendall

Status
Shimmy
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125087?

A vulnerability has been identified in the Michael-A-Kuykendall Shimmy Inference API, specifically within an unknown function of the file src/server.rs. This flaw allows for missing authentication, potentially enabling remote attacks. It is crucial to upgrade to version 2.6.5 to address this security issue, which has been patched under commit 3f2ee748c02eeb229987913fe289a2ed9a24595d. Organizations using Shimmy should take immediate action to mitigate risks associated with this vulnerability.

Affected Version(s)

Shimmy 2.6.0

Shimmy 2.6.1

Shimmy 2.6.2

References

https://vuldb.com/vuln/433198
vdb-entry
https://vuldb.com/vuln/433198/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-125087
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

geochen (VulDB User)
.