CVE-2026-6588
Received Received - Intake
Authentication Bypass in Serge-Chat Model API Enables Remote Exploit

Publication date: 2026-04-20

Last updated on: 2026-04-29

Assigner: VulDB

Description
A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model.py of the component Model API Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-20
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-04-20
EPSS Evaluated
2026-06-15
NVD
CVE-2026-6588
EUVD
EUVD-2026-23729
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
serge-chat serge to 1.4TB (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the serge-chat serge software up to version 1.4TB, specifically in the download_model and delete_model functions of the Model API Endpoint component. An attacker can exploit this weakness remotely by manipulating these functions, which can lead to missing authentication controls.

Because authentication can be bypassed, unauthorized users might be able to perform actions that should require proper credentials.

Impact Analysis

The impact of this vulnerability is that an attacker can remotely exploit the missing authentication to perform unauthorized actions on the affected system.

This could lead to unauthorized deletion or downloading of models via the API, potentially compromising the integrity and availability of the system's data.

Compliance Impact

The vulnerability allows for missing authentication in the Model API Endpoint, which can be exploited remotely. This weakness could potentially lead to unauthorized access or manipulation of data.

However, there is no specific information provided about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability can be detected by checking for unauthenticated access to the model management API endpoints under the path `/api/model/*` in the Serge chat application.

  • Use an unauthenticated GET request to enumerate all models: `curl -X GET http://<target>/api/model/all`
  • Attempt to trigger a model download without authentication: `curl -X POST http://<target>/api/model/{model_name}/download`
  • Try to cancel a download without authentication: `curl -X POST http://<target>/api/model/{model_name}/download/cancel`

If these commands succeed without requiring authentication, it indicates the presence of the vulnerability.

Mitigation Strategies

Immediate mitigation steps include restricting access to the model management API endpoints to prevent unauthenticated requests.

  • Implement authentication checks on all `/api/model/*` endpoints, ensuring only authorized users can access them.
  • Restrict network access to the affected endpoints by using firewall rules or network segmentation to limit exposure.
  • Monitor disk usage closely to detect abnormal spikes that may indicate exploitation attempts.

Since no official patches or fixes are available, these steps help reduce the risk until a vendor update is released.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6588. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart