Executive brief
TorchServe vulnerable to bypass of allowed_urls configuration
Affected products
- PyPI torchserve
Junglewise Threat Intelligence
CVE-2024-35198: PYSEC-2026-554 - TorchServe vulnerable to bypass of allowed_urls configuration
CVE-2024-35198 · Severity: low · CVSS 3.1 · Published 2026-06-29
Technologies: torchserve (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1973 - TorchServe script references S3 bucket without ensuring ownership or confirming accessibility
- PYSEC-2026-1971 - TorchServe gRPC Port Exposure
- PYSEC-2026-1972 - TorchServe ZipSlip
- PYSEC-2026-553 - TorchServe Server-Side Request Forgery vulnerability
- TorchServe Pre-Auth Remote Code Execution