Two Critical CVEs Hit Hugging Face: TGI DoS (CVE-2026-0599) and LeRobot Unauthenticated RCE (CVE-2026-25874)

What Happened

Hugging Face — the world's largest AI model hosting platform — is dealing with two critical vulnerabilities in its core infrastructure projects. CVE-2026-0599 (CVSS 7.5) affects Text Generation Inference (TGI), the company's production serving engine, and allows unauthenticated remote attackers to crash host machines through unbounded external image fetching. CVE-2026-25874 (CVSS 9.8) affects LeRobot, Hugging Face's open-source robotics learning framework, and allows unauthenticated remote code execution via unsafe pickle deserialization over gRPC. Both vulnerabilities require zero credentials, zero user interaction, and minimal technical skill to exploit (SentinelOne, Cloud Security Alliance).

CVE-2026-0599 — TGI Unbounded Image Fetch (DoS)

Text Generation Inference is Hugging Face's production-grade serving engine used by thousands of organizations to deploy large language models and vision-language models (VLMs) at scale. The vulnerability exists in TGI version 3.3.6 and below, specifically when operating in VLM mode.

The attack vector is deceptively simple: when the TGI router processes user input containing Markdown image links (![](url)), it performs a blocking HTTP GET request to fetch the referenced image, reading the entire response body into memory and cloning it before any size validation or token limit check occurs. An attacker can supply URLs pointing to arbitrarily large resources — or simply flood the server with requests containing many image tags — to exhaust memory, saturate network bandwidth, and spike CPU utilization simultaneously (GitHub Advisory GHSA-j7x9-7j54-2v3h).

Key facts:

• Affected: text-generation-inference < 3.3.7
• Attack vector: Unauthenticated HTTP requests with crafted Markdown image links
• Impact: Memory exhaustion, bandwidth saturation, CPU overutilization, host crash
• Default config makes it worse: Default deployments lack both memory usage limits and authentication
• The vulnerability triggers even if the request is later rejected for exceeding token limits — the damage happens during input validation, before rejection logic runs
• Patched in: TGI 3.3.7, which adds proper bounds checking and resource controls for external image fetching

CVE-2026-25874 — LeRobot Unauthenticated RCE via Pickle

LeRobot is Hugging Face's framework for training and deploying machine learning policies on real robotic hardware. It is not a web application — it controls physical robots. The vulnerability resides in the async inference PolicyServer component, which listens on a network port and deserializes incoming data using Python's pickle.loads() — on unauthenticated, unencrypted gRPC channels (PurpleOps).

The attack requires nothing more than network access to the PolicyServer port. An attacker crafts a malicious serialized Python object; when pickle.loads() deserializes it, embedded system commands execute with the permissions of the running process. No credentials. No multi-step chain. No user interaction (Resecurity).

Key facts:

• Affected: LeRobot all versions through 0.5.1
• CVSS 3.1: 9.8 (Critical) — CWE-502: Deserialization of Untrusted Data
• Attack vector: Crafted pickle payload over unauthenticated gRPC to PolicyServer
• Impact: Full arbitrary OS command execution on the host
• Physical safety risk: LeRobot controls real robotic hardware. RCE means an attacker could cause service disruption, sabotage, or physical safety incidents if robots are connected
• Unpatched as of April 28, 2026 public disclosure: A fix is planned for v0.6.0 but has not yet shipped

Who's Affected

These vulnerabilities hit two distinct but overlapping audiences:

• TGI (CVE-2026-0599): Any organization running Hugging Face's Text Generation Inference in production — particularly those using VLM mode with models like LLaVA, IDEFICS, or any vision-capable deployment. Given that TGI is the recommended serving backend for Hugging Face Inference Endpoints, the blast radius includes a significant portion of the AI production ecosystem.
• LeRobot (CVE-2026-25874): Robotics labs, manufacturing environments, and research institutions running LeRobot's PolicyServer in any network-accessible configuration. The physical safety dimension makes this especially urgent for any deployment connected to real hardware.
• Shared risk: Organizations using both TGI and LeRobot in their AI/ML pipeline face compounded exposure — a DoS vector on the inference side and an RCE vector on the robotics side.

How to Protect Yourself

For CVE-2026-0599 (TGI):

1. Upgrade to TGI 3.3.7 immediately. This is the patched version with proper bounds checking on external image fetching.
2. If you cannot upgrade: Disable VLM mode entirely if your deployment does not require vision-language model support. This eliminates the attack surface.
3. Enable authentication on all TGI endpoints. The default deployment lacks auth — adding it reduces the unauthenticated attack surface.
4. Set memory limits on TGI containers/processes to limit the impact of any successful memory exhaustion attempt.
5. Monitor for anomalous request patterns — inputs with excessive Markdown image tags or repeated large-payload requests.

For CVE-2026-25874 (LeRobot):

1. Isolate the PolicyServer immediately. Since no patch has shipped yet, network-level containment is the primary defense. Block all external access to the PolicyServer port.
2. Disable async inference if your workflow does not require it. This removes the vulnerable code path entirely.
3. Audit for prior compromise. Check logs for unexpected gRPC connections to the PolicyServer port. Look for anomalous process execution or unexpected network connections from the LeRobot host.
4. Plan for v0.6.0. Monitor the LeRobot repository for the patched release and upgrade as soon as it ships.
5. If connected to physical hardware: Consider disconnecting robots from the network until the PolicyServer is patched or isolated. The physical safety risk is real and unmitigated by software alone.

The Sable Angle

These two CVEs expose a pattern that offensive security teams have been flagging for years: the AI/ML supply chain is the new attack surface. TGI and LeRobot aren't traditional IT infrastructure — they're specialized AI tooling that most security teams haven't inventoried, let alone hardened. Yet they run production workloads, control physical hardware, and process untrusted user input.

The pickle deserialization in CVE-2026-25874 is a vulnerability class that's been known since 2011 — it's not novel, it's neglected. The unbounded fetch in CVE-2026-0599 is a resource exhaustion pattern that's been understood for decades. These aren't zero-days in the traditional sense; they're zero-days in the attention sense. The AI ecosystem is moving faster than the security practices around it.

At Sable, our offensive engineers include AI/ML infrastructure in every engagement scope — because attackers certainly are. If you're running TGI, LeRobot, or any AI serving stack in production, reach out before someone else finds these gaps for you. Check our research archive for more on AI supply chain threats.