OpenMed: unauthenticated model_name routes to a trust_remote_code loader and executes attacker code

Impact

The privacy-filter dispatcher matched the user-supplied model_name by substring, so a value like attacker/foo-privacy-filter-bar routes into a Hugging Face load with trust_remote_code=True. The attacker publishes a repo whose config.json or tokenizer_config.json declares an auto_map, and the custom Transformers code is imported and executed as the OpenMed service process - on the inference host, with whatever the service account holds and whatever GPUs the process has open. This is the standard remote-code-in-a-model-repo failure, reachable here without authentication. Public exploit code exists in the references, so treat exposed instances as already at risk.

Who can reach it

Anyone who can send a request to the OpenMed service with a chosen model_name. No authentication required.

What to do

Upgrade OpenMed to 1.5.2 and restart the service - a process restart on the serving host, no node drain. Until then, block or allowlist the model_name parameter at the ingress so only known-good repository names reach the dispatcher, and treat any instance that was network-reachable as potentially executed against.

References

Related entries

• MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical
• LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical
• Headroom: client-supplied x-headroom-user-id header is trusted as identity, exposing other users' memoryCVE-2026-77776 · Headroom LLM proxy (x-headroom-user-id header treated as identity)Critical
• llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
• Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical
• Qdrant (snapshot recovery): Arbitrary file read and write during snapshot recoveryCVE-2024-3829 · Qdrant (snapshot recovery)Critical