CVE-2026-76841: Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 expos
Summary
Xinference (a model-serving tool) was loading AI models from Hugging Face with remote code execution (the ability to run code from external sources) always enabled before version 2.12.0, and users had no way to turn it off. An attacker who could register a new model could trick the system into running malicious code hidden in the model's configuration files, giving that code the same permissions as the server running Xinference.
Solution / Mitigation
Version 2.12.0 fixes this by adding a new setting called allow_trust_remote_code and an environment variable XINFERENCE_TRUST_REMOTE_CODE that gates remote code execution. After the update, remote code is only allowed for built-in models that come bundled with Xinference.
Vulnerability Details
8.8(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
network
low
low
none
August 24, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-76841
First tracked: August 24, 2026 at 02:09 PM
Classified by LLM (prompt v3) · confidence: 95%