CVE-2026-125087

Network-exposed Shimmy inference could accept requests without a key

Shimmy project · Shimmy inference API

First documented disclosure · Review checkpoint

Summary

Affected inference endpoints could be used by callers who had network access to the service.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The inference server and example deployment configurations did not consistently require authentication for externally reachable endpoints.

Conditions required

The instance is reachable on a network interface and lacks a protective authentication layer.

Potential impact

Unauthenticated use could consume inference capacity or expose functionality available through the server.

Affected versions and configurations

VulDB identifies versions through 2.6.4.

Fix and mitigation status

2.6.5.

Practical next steps

Upgrade to 2.6.5, require a service key for network access and review existing deployment configurations.

Operating lesson

Make authentication mandatory in the network-facing configuration shipped to operators.

Evidence and limits

The fixed release documents changes to the server and deployment templates. The issue does not name a compromised operator.

Sources