CVE-2026-125087

A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component.

• CWE-287
• CWE-306

• https://github.com/Michael-A-Kuykendall/shimmy/
• https://github.com/Michael-A-Kuykendall/shimmy/commit/3f2ee748c02eeb229987913fe289a2ed9a24595d
• https://github.com/Michael-A-Kuykendall/shimmy/issues/221
• https://github.com/Michael-A-Kuykendall/shimmy/releases/tag/v2.6.5
• https://vuldb.com/cve/CVE-2026-125087
• https://vuldb.com/submit/1042415
• https://vuldb.com/vuln/433198
• https://vuldb.com/vuln/433198/cti

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125076A vulnerability was found in SourceCodester Smart Attendance…7.3
• CVE-2026-125077A vulnerability was determined in SourceCodester Smart Atten…4.3
• CVE-2026-125078A security flaw has been discovered in SourceCodester Smart …6.3
• CVE-2026-125079A vulnerability was determined in D-Link DCS-6501LH 3.03.02.…5.3
• CVE-2026-125082A security flaw has been discovered in sunkaifei FlyCMS up t…3.5
• CVE-2026-125086A vulnerability has been found in D-Link M60 1.12.B01. Impac…10
• CVE-2026-125095FFmpeg through 9.0.2 contains an uninitialized memory use vu…3.3
• CVE-2026-125096FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-125097FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-125098FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125099FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-1251The SupportCandy – Helpdesk & Customer Support Ticket System…5.4