PT-2025-27527 · Unknown · Ai-Inference-Server

Bzimport · Published 2025-06-30 · Updated 2025-08-18 · CVE-2025-6920

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ai-inference-server (affected versions not specified)

Description: A flaw was found in the authentication enforcement mechanism of a model inference API. The issue affects the "/v1/*" endpoints, where API key validation is expected but not properly enforced, particularly in the "POST /invocations" endpoint. This results in an authentication bypass, allowing unauthorized users to access protected endpoints and potentially exposing sensitive functionality or allowing unintended access to backend resources.

Recommendations: As a temporary workaround, consider disabling the "POST /invocations" endpoint until a patch is available. Restrict access to the "/v1/*" endpoints to minimize the risk of exploitation. Avoid using the ai-inference-server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-16259

CVE-2025-6920

Affected Products

Ai-Inference-Server

References · 10

• https://bugzilla.redhat.com/show_bug.cgi?id=2375522 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-6920 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16259 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6920 · Security Note
• https://twitter.com/VulmonFeeds/status/1940066412296327362 · Twitter Post
• https://twitter.com/ZeroDayCVE/status/1940301970327363994 · Twitter Post
• https://access.redhat.com/security/cve/cve-2025-6920 · Note
• https://twitter.com/CVEnew/status/1940044272268419199 · Twitter Post
• https://t.me/cveNotify/132713 · Telegram Post
• https://t.me/cvetracker/27512 · Telegram Post