CVE-2026-85668: External Control of File Name or Path in xorbitsai inference

CVE-2026-85668 describes an unauthenticated arbitrary-path file read vulnerability in the xorbitsai inference product, specifically in Xinference version 3.x at commit 4a94832. The POST /v1/models/llm/auto-register endpoint accepts a model_path parameter from callers without authentication or path confinement. It reads and parses config.json, tokenizer_config.json, and chat_template.jinja files located at the supplied path and returns their parsed content to the caller. This allows an unauthenticated attacker to probe the server filesystem and extract the contents of these files from any directory.

An unauthenticated attacker can read arbitrary files named config.json, tokenizer_config.json, and chat_template.jinja from any directory on the server hosting the vulnerable Xinference service. This leads to unauthorized disclosure of potentially sensitive configuration data, which could aid further attacks or information gathering. There is no indication of privilege escalation or code execution from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable endpoint and monitor for suspicious requests targeting the model_path parameter. Implement authentication and path validation controls if possible to limit exposure.