ai-inference-server Authentication Bypass Vulnerability in Model Inference API

An authentication bypass vulnerability has been identified in the ai-inference-server model inference API. All /v1/* endpoints are supposed to validate API keys, but the POST /invocations endpoint does not, allowing unauthorized users to access inference features available on protected endpoints. This could lead to exposure of sensitive functionality or unintended access to backend resources.

Impact

Exploiting this vulnerability allows unauthorized users to access protected inference features, potentially leading to abuse of those functionalities. According to Red Hat, this could involve accessing or manipulating sensitive data, utilizing administrative functions, or even executing arbitrary code, depending on the context.