PT-2026-33657 · Unknown · Serge-Chat

Eric-A · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6588

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions serge-chat versions prior to 1.4TB

Description A flaw in the Model API Endpoint allows remote attackers to bypass authentication. This issue exists within the download model and delete model functions located in the 'api/src/serge/routers/model.py' file. Exploitation of this weakness can lead to unauthorized actions, including the deletion of models, and has been observed in real-world incidents.

Recommendations Update to a version later than 1.4TB. As a temporary workaround, restrict access to the download model and delete model functions in the Model API Endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2026-6588

Affected Products

Serge-Chat

References · 7

• 🔥 https://gist.github.com/YLChen-007/5fbc93a21f9928e91a72ab0d72fb1e88 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6588 · Security Note
• https://vuldb.com/vuln/358223 · Note
• https://vuldb.com/submit/791089 · Note
• https://twitter.com/VulmonFeeds/status/2046046997753278546 · Twitter Post
• https://twitter.com/NewsNerdie/status/2046137425794130204 · Twitter Post
• https://vuldb.com/vuln/358223/cti · Note