What it is
Coordination endpoints, metadata services, cache coordinators and job submission interfaces bind to all interfaces with no authentication, on the stated assumption of a trusted network. In practice these land on cloud VPCs, shared clusters and sometimes public addresses.
The assumption is usually documented, which turns a defect into a deployment requirement in the maintainers' view. That is defensible for a library and dangerous for a product.
Variants and records
Job submission API
A management interface that accepts work is left open with no login. Anyone who can reach it can run code on the cluster.
Ray 2.6.3 and 2.8.0, CVE-2023-48022. The vendor disputes it as a deployment assumption. Attackers did exploit exposed Ray clusters: Oligo's ShadowRay (March 2024) and ShadowRay 2.0 (November 2025).
KV transfer coordination
The service that coordinates moving cache data between machines listens on every network interface, even when told to use one. Anyone on that network can talk to it.
vLLM PyNcclPipe, CVE-2025-47277, versions 0.6.5 to before 0.8.5.
Cache transport
A cache-sharing service accepts connections with no authentication. If it is bound to a reachable address, anyone who connects can send it commands.
LMCache multiprocess transport, CVE-2026-105192, published 2026-10-13, critical (9.8) when bound to a routable address. The default bind is localhost. Fixed in 0.5.6.
One rule. Bind internal services privately, and require mutual authentication on anything that moves cache state or accepts work.
Check your stack
Tests
Each test has a positive control: a condition under which it must fail. A test that cannot fail proves nothing. These are procedures. Hedgerow has not run them.
Socket inventory
- Do
- List listening sockets on every workload and compare with an allowlist.
- Pass
- Every socket is on the list and authenticates its caller.
- Must fail when
- A debug port is opened on a staging pod.
Cross-pod call
- Do
- From an unrelated pod, call each internal plane without credentials.
- Pass
- Every call is refused.
- Must fail when
- The network policy is removed, so the calls succeed.
Default bind
- Do
- Start each component with default configuration and check the bind address.
- Pass
- Loopback or a private overlay.
- Must fail when
- A component known to default to all interfaces is included.
Mapping to AISVS, ATLAS and CWE
| Framework | Mapping |
|---|---|
| OWASP AISVS 1.01 | Closest: 5.2.1 (every AI resource, including endpoints and compute instances, enforces default-deny access control) and 4.2.5 (accelerator interconnects use authenticated endpoints, level 3). |
| MITRE ATLAS 5.6.0 | AML.T0049 Exploit Public-Facing Application. |
| CWE | CWE-306 Missing Authentication for Critical Function, and CWE-1327 Binding to an Unrestricted IP Address (Hedgerow proposals; the cited advisories carry their own CWEs). |
Controls
- Bind internal services to loopback or a private overlay.
- Require mutual authentication on any interface that moves cache state or accepts work.
- Default-deny network policy between namespaces.
- Treat "assume a trusted network" in documentation as a finding, and record who owns producing that network.
What this page does not claim
- The tests have not been run by Hedgerow.
- Standards mappings reflect the versions named and may change as they do.
- A cited record shows the mechanism occurred in at least one implementation. It does not say any given system is affected.