Database/AI/ML frameworks & serving
TorchServe: Unauthenticated SSRF
Impact
Unauthenticated SSRF → arbitrary model download → RCE on the serving host
Who can reach it
Unauthenticated network to an exposed TorchServe management port (8081), default config binds broadly
What to do
Patch to 0.8.2+, restrict allowed_urls, and firewall 8080/8081/7070/7071 off any tenant-reachable network. Providers who publish TorchServe images must ship the hardened default
Fleet impact
How widespread
Common - TorchServe is the default PyTorch model server on SageMaker-style managed inference and on many neocloud inference offerings
Cost to remediate
daemon-restart - upgrade to TorchServe 0.8.2+ and bind management_address to 127.0.0.1; restarting the server drops in-flight inference but does not require a node reboot
Why it hits the whole fleet
The management API listened on 0.0.0.0 with no auth and accepted model URLs from *any* domain, so an unauthenticated attacker uploads a malicious model archive and gets RCE on every exposed inference host at once
References
Related entries
- TorchServe: `allowed_urls` bypassCVE-2024-35198 · TorchServeCritical
- BentoML: Insecure deserializationCVE-2024-2912 · BentoMLCritical
- llama.cpp (RPC backend): Unsafe `data` pointer in `rpc_tensor`CVE-2024-42479 · llama.cpp (RPC backend)Critical
- MLflow (`extract_archive_to_dir`): Path traversal in the dbconnect artifact cacheCVE-2025-15036 · MLflow (`extract_archive_to_dir`)Critical
- vLLM (Mooncake ZMQ/TCP): Unsafe deserialization exposed on all interfacesCVE-2025-32444 · vLLM (Mooncake ZMQ/TCP)Critical
- ChromaDB: Pre-authentication code injectionCVE-2026-45829 · ChromaDBCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.