Xinference 4.0.1 adds an RCE defense you must switch on

Xinference 4.0.1 brings a defense against unauthenticated actor-message code execution, but installing the update is only half the job. The October 16 release requires Xoscar 0.12.0 or newer and passes its authentication key through standalone and distributed Docker Compose services. Protection remains off unless administrators configure a nonempty key.

The Xoscar advisory, CVE-2026-49950, describes a deserialization boundary: an untrusted party that can reach an unauthenticated actor-pool port can execute Python code with the receiving process’s privileges. That includes deployments built on Xoscar, such as Xinference, when network policy allows untrusted peers to connect. An HTTP API password or token does not secure this separate transport.

Upgrade, configure every peer, then restart

The release tells operators to upgrade every Xinference server to 4.0.1 and any direct actor clients to Xoscar 0.12.0 or later. Its documented Python installation route is pip install xinference; operators should check the version delivered in their environment against the release rather than assuming an existing container is current.

Administrators then generate one random deployment secret, distribute it through their secret-management system and set the same XOSCAR_AUTH_KEY before starting every supervisor, worker and direct actor client. Child processes inherit the key. Ordinary HTTP clients do not need it.

Keyed and unkeyed peers cannot communicate. Enabling or rotating the key therefore requires a coordinated restart, with no automatic downgrade or mixed-mode rolling upgrade. Restricting actor ports to intended cluster peers remains necessary.

Authentication is not encryption

The advisory explicitly includes Xoscar 0.12.0 in its affected range because the default unauthenticated configuration remains exposed. A version number alone is not evidence of protection.

Configured authentication verifies messages before Python-object deserialization. It does not encrypt traffic or prevent replay, and anyone holding the shared key remains a trusted peer with Python execution privileges. Authenticated GPU transfers also add CPU and host-memory overhead for hashing.

Xinference is model-serving infrastructure, not a model-provider subscription or a coding-agent plugin. AITrending reviewed the maintainers’ English release, advisory and deployment guidance; it has not reproduced the vulnerability or tested this rollout. These sources do not establish exploitation in real deployments.