Unauthenticated inference API flaw disclosed in Shimmy LLM server

On November 10, 2026, GitHub Security Advisories disclosed GitHub Security Advisory GHSA-h7qf-5c8w-fgjc, reporting that Shimmy, a lightweight local LLM inference server marketed as an alternative to Ollama, allowed network callers to query its Inference API without authentication.

What changed

• Published as GHSA-h7qf-5c8w-fgjc on November 10, 2026, and tracked as CVE-2026-125087, classified under CWE-287 (Improper Authentication).
• Affects Shimmy versions up to and including 2.6.4; fixed in version 2.6.5.
• The vulnerable component is the Inference API inside src/server.rs.
• The API can be called over the network without authentication, and requires no privileges or user interaction.
• CVSS v4.0 score is listed as 5.5, with exploit maturity marked as proof-of-concept.

What it means for AI builders

Shimmy is used by developers to self-host an OpenAI-API-compatible inference server locally or on-prem, often because its single Rust binary is about 5MB compared with Ollama's roughly 680MB footprint. An unauthenticated Inference API means any network-adjacent actor can query it without credentials, potentially running up compute costs or using it as a foothold to pivot further. GitHub's advisory places this alongside a recent pattern of fast but exposed-by-default AI tooling, including advisories affecting GPUStack, Langflow and NocoBase.

Fix and availability

The fix ships in Shimmy version 2.6.5; anyone running version 2.6.4 or earlier should upgrade. The affected project is maintained in the github.com/Michael-A-Kuykendall/shimmy repository, where the Inference API in src/server.rs is the component GitHub's advisory identifies as vulnerable.

Sources

• Shimmy Inference API Missing Authentication (GHSA-h7qf-5c8w-fgjc) (GitHub Security Advisories, November 10, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.