CVE-2025-6920

Katalog CVE

CVSS 5.3 · Medium EPSS 0,29%

Kerentanan Missing Authentication for Critical Function pada redhat ai inference server. Skor CVSS 3.1 5.3 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API key validation. However, the POST /invocations endpoint failed to do so, resulting in an authentication bypass. This vulnerability allows unauthorized users to access the same inference features available on protected endpoints, potentially exposing sensitive functionality or allowing unintended access to backend resources.

Rincian

Terbit di NVD

1 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2025-6920 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2375522 issue tracking · advisory vendor