Search
Find a vulnerability
Search criteria
4 vulnerabilities found for ai-infra-guard by tencent
CVE-2026-84809 (GCVE-0-2026-84809)
Vulnerability from nvd – Published: 2026-09-02 16:59 – Updated: 2026-09-04 02:48
VLAI
EPSS
VEX
Title
Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode
Summary
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 02:48 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Tencent/AI-Infra-Guard/issues/531 | issue-tracking |
| https://github.com/Tencent/AI-Infra-Guard/commit/… | patch |
| https://github.com/Tencent/AI-Infra-Guard/blob/v4… | technical-description |
| https://github.com/Tencent/AI-Infra-Guard/blob/v4… | technical-description |
| https://github.com/Tencent/AI-Infra-Guard | product |
| https://www.vulncheck.com/advisories/tencent-ai-i… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tencent | AI-Infra-Guard |
Affected:
0 , < 4.5.2
(semver)
Affected: 4.6.0 , ≤ 4.6.0 (semver) |
|
| Tencent | aig-skill-scan |
Affected:
0 , ≤ 0.2.1
(semver)
|
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84809",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T02:48:03.204497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T02:48:28.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/issues/531"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Tencent/AI-Infra-Guard",
"product": "AI-Infra-Guard",
"vendor": "Tencent",
"versions": [
{
"lessThan": "4.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.6.0",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"packageName": "aig-skill-scan",
"packageURL": "pkg:pypi/aig-skill-scan",
"product": "aig-skill-scan",
"vendor": "Tencent",
"versions": [
{
"lessThanOrEqual": "0.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tencent:ai-infra-guard:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tencent:ai-infra-guard:4.6.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nedlir"
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tencent AI-Infra-Guard\u0027s skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:59:48.800Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #531",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/issues/531"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/commit/7e0f749e3c023e5c6ab7b32fe97b3f6f2e8aeb04"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/blob/v4.6.0/skill-scan/skill_scan/tools/dir/dir_actions.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/blob/v4.6.0/skill-scan/skill_scan/utils/pre_scan.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tencent/AI-Infra-Guard"
},
{
"name": "VulnCheck Advisory: Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tencent-ai-infra-guard-skill-scan-analysis-bypass-via-excluded-python-bytecode"
}
],
"title": "Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-84809",
"datePublished": "2026-09-02T16:59:48.800Z",
"dateReserved": "2026-09-02T10:19:32.992Z",
"dateUpdated": "2026-09-04T02:48:28.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5585 (GCVE-0-2026-5585)
Vulnerability from nvd – Published: 2026-04-05 17:30 – Updated: 2026-04-06 18:01
VLAI
EPSS
VEX
Title
Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure
Summary
A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 18:01 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/355384 | vdb-entry |
| https://vuldb.com/vuln/355384/cti | signaturepermissions-required |
| https://vuldb.com/submit/784198 | third-party-advisory |
| https://gist.github.com/YLChen-007/fe4b834144ad53… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tencent | AI-Infra-Guard |
Affected:
4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5585",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T18:01:04.937076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T18:01:16.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Task Detail Endpoint"
],
"product": "AI-Infra-Guard",
"vendor": "Tencent",
"versions": [
{
"status": "affected",
"version": "4.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-y (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T17:30:10.903Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-355384 | Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/355384"
},
{
"name": "VDB-355384 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/355384/cti"
},
{
"name": "Submit #784198 | Tencent AI-Infra-Guard \t4.0 \tInformation Disclosure (CWE-200)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/784198"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/fe4b834144ad535d167507c2008d4011"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-04T23:38:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5585",
"datePublished": "2026-04-05T17:30:10.903Z",
"dateReserved": "2026-04-04T21:33:44.168Z",
"dateUpdated": "2026-04-06T18:01:16.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84809 (GCVE-0-2026-84809)
Vulnerability from cvelistv5 – Published: 2026-09-02 16:59 – Updated: 2026-09-04 02:48
VLAI
EPSS
VEX
Title
Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode
Summary
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 02:48 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Tencent/AI-Infra-Guard/issues/531 | issue-tracking |
| https://github.com/Tencent/AI-Infra-Guard/commit/… | patch |
| https://github.com/Tencent/AI-Infra-Guard/blob/v4… | technical-description |
| https://github.com/Tencent/AI-Infra-Guard/blob/v4… | technical-description |
| https://github.com/Tencent/AI-Infra-Guard | product |
| https://www.vulncheck.com/advisories/tencent-ai-i… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tencent | AI-Infra-Guard |
Affected:
0 , < 4.5.2
(semver)
Affected: 4.6.0 , ≤ 4.6.0 (semver) |
|
| Tencent | aig-skill-scan |
Affected:
0 , ≤ 0.2.1
(semver)
|
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84809",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T02:48:03.204497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T02:48:28.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/issues/531"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Tencent/AI-Infra-Guard",
"product": "AI-Infra-Guard",
"vendor": "Tencent",
"versions": [
{
"lessThan": "4.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.6.0",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"packageName": "aig-skill-scan",
"packageURL": "pkg:pypi/aig-skill-scan",
"product": "aig-skill-scan",
"vendor": "Tencent",
"versions": [
{
"lessThanOrEqual": "0.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tencent:ai-infra-guard:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tencent:ai-infra-guard:4.6.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nedlir"
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tencent AI-Infra-Guard\u0027s skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:59:48.800Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #531",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/issues/531"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/commit/7e0f749e3c023e5c6ab7b32fe97b3f6f2e8aeb04"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/blob/v4.6.0/skill-scan/skill_scan/tools/dir/dir_actions.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Tencent/AI-Infra-Guard/blob/v4.6.0/skill-scan/skill_scan/utils/pre_scan.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tencent/AI-Infra-Guard"
},
{
"name": "VulnCheck Advisory: Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tencent-ai-infra-guard-skill-scan-analysis-bypass-via-excluded-python-bytecode"
}
],
"title": "Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-84809",
"datePublished": "2026-09-02T16:59:48.800Z",
"dateReserved": "2026-09-02T10:19:32.992Z",
"dateUpdated": "2026-09-04T02:48:28.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5585 (GCVE-0-2026-5585)
Vulnerability from cvelistv5 – Published: 2026-04-05 17:30 – Updated: 2026-04-06 18:01
VLAI
EPSS
VEX
Title
Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure
Summary
A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 18:01 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/355384 | vdb-entry |
| https://vuldb.com/vuln/355384/cti | signaturepermissions-required |
| https://vuldb.com/submit/784198 | third-party-advisory |
| https://gist.github.com/YLChen-007/fe4b834144ad53… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tencent | AI-Infra-Guard |
Affected:
4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5585",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T18:01:04.937076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T18:01:16.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Task Detail Endpoint"
],
"product": "AI-Infra-Guard",
"vendor": "Tencent",
"versions": [
{
"status": "affected",
"version": "4.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-y (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T17:30:10.903Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-355384 | Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/355384"
},
{
"name": "VDB-355384 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/355384/cti"
},
{
"name": "Submit #784198 | Tencent AI-Infra-Guard \t4.0 \tInformation Disclosure (CWE-200)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/784198"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/fe4b834144ad535d167507c2008d4011"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-04T23:38:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5585",
"datePublished": "2026-04-05T17:30:10.903Z",
"dateReserved": "2026-04-04T21:33:44.168Z",
"dateUpdated": "2026-04-06T18:01:16.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}