CVE-2026-125087— Michael-A-Kuykendall Shimmy Inference API server.rs missing authentication

Quick assessment

Affected

Michael-A-Kuykendall Shimmy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Michael-A-Kuykendall 的 Shimmy 项目（版本 2.6.4 及更早版本）中发现了一个安全漏洞。受影响的元素位于组件"Inference API"的文件中的一个未知函数。攻击者通过操纵该函数可导致身份验证机制失效。该攻击可远程实施。将组件升级至版本 2.6.5 即可修复此问题，相关补丁提交哈希为。建议您尽快升级受影响的组件。

CVSS 7.3 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1021 · Remote Services T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Michael-A-Kuykendall Shimmy Inference API server.rs missing authentication

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Michael-A-Kuykendall	Shimmy	2.6.0	`cpe:2.3:a:michael-a-kuykendall:shimmy::::::::`

II. Public POCs for CVE-2026-125087

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125087

请登录查看更多情报信息。

Other References for CVE-2026-125087 (1)

CVE-2026-125087 | Michael-A-Kuykendall Shimmy up to 2.6.4 Inference API src/server.rs missing authentication (Issue 221) vdb-entry

Other References for CVE-2026-125087 (7)

https://github.com/Michael-A-Kuykendall/shimmy/ product
https://github.com/Michael-A-Kuykendall/shimmy/commit/3f2ee748c02eeb229987913fe289a2ed9a24595d patch
https://github.com/Michael-A-Kuykendall/shimmy/issues/221 issue-tracking
https://github.com/Michael-A-Kuykendall/shimmy/releases/tag/v2.6.5 patch
https://vuldb.com/cve/CVE-2026-125087 third-party-advisory
https://vuldb.com/vuln/433198/cti signature permissions-required
https://vuldb.com/submit/1042415 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125087

IV. Related Vulnerabilities

Same weakness: CWE-306