Remote Code Execution Vulnerability in Xinference by Xorbits AI
CVE-2026-76841

8.7HIGH

Key Information:

Vendor

Xorbitsai

Status
Inference
Vendor
CVE Published:
24 August 2026

What is CVE-2026-76841?

The Xinference product allows remote code execution due to the unconditional enabling of model loading from Hugging Face. This vulnerability affects various loader functions that pass a default parameter allowing remote code execution. Specifically, models can be registered with an unknown type and supply arbitrary model paths, which could lead to unauthorized code execution with worker privileges. The issue has been mitigated in version 2.12.0, where settings to control remote code execution have been implemented, requiring explicit permission for executing non-bundled models.

Affected Version(s)

inference 0 < 2.12.0

References

https://github.com/xorbitsai/inference
product
https://github.com/xorbitsai/inference/issues/5023
issue-tracking
https://github.com/xorbitsai/inference/pull/5027
issue-tracking

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fiona
.