CVE-2026-125087 Michael-A-Kuykendall Shimmy Inference API server.rs missing authentication

Medium 6.9 Published 10 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125087?

CVE-2026-125087 is a medium-severity vulnerability in Michael-A-Kuykendall Shimmy, published on 10 Nov 2026.

Official description

A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component.

Weakness: CWE-306, CWE-287

Which versions are affected by CVE-2026-125087?

How do I fix CVE-2026-125087?

No fix has been published for CVE-2026-125087 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125087 being exploited?

There is no known exploitation of CVE-2026-125087 in the wild and no public exploit code.

Sources

Also known as GHSA-h7qf-5c8w-fgjc.