CVE-2026-76841
Received Received - Intake

Remote Code Execution in Xinference Prior to 2.12.0

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._get_tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence_transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence_transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches _auto_detect_type and then AutoTokenizer.from_pretrained, which imports and executes Python declared by the model directory's own tokenizer_config.json auto_map, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code only for bundled built-in models.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76841
EUVD
EUVD-2026-64847

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xinference xinference to 2.12.0 (exc)
xorbitsai xinference to 2.12.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76841 is a Remote Code Execution (RCE) vulnerability in the Xinference inference server affecting versions up to 2.11.0. The issue occurs because six model-loader call sites hardcode the trust_remote_code=True parameter, allowing arbitrary code execution from remote model repositories. Attackers with model launch access can register malicious models to trigger code execution via Hugging Face's AutoTokenizer.from_pretrained function, running code with worker process privileges.

Version 2.12.0 mitigates this by requiring explicit configuration (allow_trust_remote_code and XINFERENCE_TRUST_REMOTE_CODE) to enable remote code execution, restricting it to bundled built-in models only.

Detection Guidance

Check if your Xinference server version is below 2.12.0 by running: pip show xinference or xinference --version. Inspect model loader configurations for hardcoded trust_remote_code=True settings in files like core.py. Monitor network traffic for suspicious POST requests to /register or /launch endpoints.

Impact Analysis

If you use Xinference versions up to 2.11.0, an attacker with model launch privileges could execute arbitrary code on your system. This could lead to data theft, system compromise, or unauthorized access. The impact depends on the privileges of the Xinference worker process, which typically runs with significant system access.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., exposure of protected health information). Organizations using affected versions may face compliance violations, legal liabilities, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Xinference to version 2.12.0 or later. Set XINFERENCE_TRUST_REMOTE_CODE=0 in your environment to disable remote code execution. Restrict model registration permissions to trusted users only. Review and remove any untrusted models from your server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart