Copy link to this section

C3 AI 8.10 Patch Notes

Last updated: November 3, 2026

The following document identifies known issues, known CVEs, and patch fixes in the C3 AI Platform 8.10 release (all these patches are backwards compatible).

Copy link to this section

8.10.12 Patch Notes

• Fixed session validation so identifiers from a session token are passed as data, not built into executable code, during cross-app session checks.
• Fixed file system access checks so paths and mount URLs that contain .. segments are rejected, directory listings and presigned URL generation are authorized, and file operations stay within the app's mounts.
• Fixed cloud service URL registration so it updates only the app's cloudServiceUrls setting and no longer overwrites other app configuration, such as the root package version, written at the same time.
• Fixed cloud message queues, such as SqsQueue, that silently stopped polling after a successful compute. Before it stops polling a broker, the platform now confirms against the database that the broker is no longer registered, and it logs a warning when it stops.
• Fixed Importable.importData so asynchronous imports queue the correct ImportDataSpec, and added a non-deprecated importData(spec) form that uses the new ImportDataSpec.async field.
• Updated the browser VS Code image to 0.4.14, which upgrades code-server to 4.141.0 and patches CVEs in components including code-server, git-lfs, Go, and OpenSSL.
• Patched CVE-2026-19445 and CVE-2026-19553 (Python) in the JupyterLab image.
• Patched CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-82208, and CVE-2026-82209 (curl and libcurl) in the JupyterLab image.
• Patched GHSA-8g5g-8vmr-9782 (Pillow) in the data-plot_312 and matplotlib_312 Python runtimes.

Copy link to this section

8.10.11 Patch Notes

• Corrected environment creation so a custom server version is applied instead of falling back to the default.
• Added app-allowlisted direct SQL access for JDBC datastores, so approved applications can run SQL queries directly.
• Added Data Quality and Ad-Hoc Reporting analyst roles that grant Studio API access.
• Fixed connection-pool shutdown errors caused by a stale pool, keeping database connections healthy.
• Improved Object Model cold-cache load time by eliminating per-package reads during dependency exclusion.
• Patched CVE-2026-75596 (netty-handler) and CVE-2026-68497 (jackson-databind).
• Patched CVEs in the bundled Java libraries, including jackson-core, protobuf-java, SnakeYAML, and Jetty.
• Patched CVEs in the OpenSSL packages, golang.org/x/crypto, and the Platform base image.
• Patched CVEs in the bundled Python libraries and OS packages, including anyio and Unbound.
• Patched CVEs in the bundled JupyterLab and JupyterHub images, including aiohttp.

Copy link to this section

8.10.10 Patch Notes

• Resolved a Studio user management issue so the user list now reloads correctly after a user is deleted.
• Corrected StudioApp endpoint resolution so the Canvas and Workflows tabs open the intended application instead of an Okta login page when multiple canonical URLs are configured.
• Removed the non-functional Generate PDF link from Stories.
• Hardened credential handling so a client-overridable safeCredentials() call on CloudMessageSourceSystem no longer runs with elevated privileges.
• Corrected SqlSourceCollection change-data-capture so a timestamp watermark continues ingesting instead of loading once and then stopping.
• Corrected CassandraDB endpoint resolution so it persists a cluster-scoped host prefix rather than local.
• Improved application startup so the Platform infers datastore request fields from the environment when they are not set in Env.StartAppSpec.
• Backported setTimeHorizon support in PsrWorkflowRunner to the 8.10 release.
• Patched critical and high-severity CVEs in the bundled Java libraries, including Netty and jline.
• Patched critical CVEs in the OpenSSL packages included with the C3 AI Platform.
• Patched high-severity CVEs in the bundled Python libraries, including PyJWT, urllib3, and msgpack.
• Patched high-severity CVEs in the bundled Node.js libraries, including brace-expansion and ip-address.

Copy link to this section

8.10.9 Patch Notes

• Resolved a privilege escalation vulnerability in the C3Type Java implementation, strengthening type-level access enforcement across the Platform.
• Patched CVEs in the bundled Java libraries.
• Patched CVEs in the C3 AI Platform base image.
• Resolved an issue where Db.Engine queue and cron processing would stop after the instance cache was evicted, keeping scheduled and queued work running continuously.
• Corrected PartitionableCompactor cron handling so crons are no longer unexpectedly activated and configured cron inputs are preserved.
• Strengthened cluster app resolution against a null-reference condition that could interrupt operations when an app was not yet registered.
• Improved environment lifecycle handling so an environment can be stopped reliably after a new dependency is added, preventing blocked threads.
• Corrected evalMetricsWithMetadata so MONTH interval results align to true calendar month boundaries rather than fixed 30-day windows, improving accuracy for historical ratio metrics.
• Ensured database snapshots are removed from disk after backup completes, preventing gradual disk usage growth on cluster nodes.
• Reduced Cassandra load by decoupling the shared database flag, improving stability for environments sharing a database.
• Aligned ActionCtxFilter.userName behavior with its documented definition for consistent action context filtering.
• Enabled email delivery for Data Validation notifications, so validation results reach subscribers through email as well as in-app alerts.
• Corrected FileSourceSystem credential updates so region and key values persist as expected, and ensured credential values are no longer shown in plaintext in error messages.
• Improved source collection file upload so adding a file no longer automatically starts processing — ingestion is now an explicit user action.
• Updated code-server to 4.130, bringing the latest editor improvements and security fixes to the integrated development experience.

Copy link to this section

8.10.8 Patch Notes

• Patched CVEs in the Jupyter image.
• Fixed evalMetricsWithMetadata MONTH interval generating 30-day fixed timestamps instead of calendar month boundaries.
• Fixed running EVAL against a data-sharing setup with different server versions.
• Fixed creating a CloudMessageSourceSystem merging existing SqlSourceSystem and FileSourceSystem unconfigured nodes into a single node.
• Fixed PartitionableCompactor crons being set to active and cron input configuration being wiped out unexpectedly.
• Fixed file upload to a source collection auto-triggering processing; ingestion is now a separate, explicit user action.
• Fixed Grafana returning a 404 Not Found error after upgrading the C3 aiOps version.

Copy link to this section

8.10.7 Patch Notes

• Fixed a dedicated-instance flag being set incorrectly when using a shared database.
• Added support for targeting Jupyter resources to a specific node pool.
• Fixed Spark fetch operations missing authentication information on executors.
• Fixed a null pointer exception in Feature.Set.CreateSnapshotJob.
• Fixed BatchExportSpec so skipFields is correctly passed down to the export target's ExportDataSpec.
• Fixed a remaining case where the Data Fusion SQL pipeline Delete existing data option targeted the wrong entity.
• Upgraded pyarrow to 23.0.1 to address a security vulnerability.
• Patched commons-beanutils findings in the c3-vad-kube image.
• Patched stdlib findings in the c3-vad-kube image.

Copy link to this section

8.10.6 Patch Notes

• Fixed Studio Stories Request Download of Topic as PDF so it no longer fails after the Node 24 bundle rebuild.
• Fixed ExMachina story PDF generation, which failed after the Node 24 upgrade.
• Patched CVEs in the containerized PostgreSQL image.
• Increased the rproxy memory limit to 256 MB.
• Fixed Jdbc.connectToDatastore so it now requires the ClusterAdmin role.
• Fixed missing translations on the Data Fusion Save Dataset node.
• Fixed JDBC connections using Azure Service Principal authentication.
• Made the MsGraph connector's base URL and token scope configurable for sovereign clouds.

Copy link to this section

8.10.5 Patch Notes

• Fixed the Data Fusion SQL pipeline Delete existing data option so it targets the correct terminal entity instead of the first immediate target.
• Fixed ExMachina story PDF generation, which failed after the Node 24 upgrade.
• Standardized the containerized PostgreSQL image on the iamguarded build to consolidate CVE remediation.
• Fixed slow startApp/getConnection calls caused by a full index-catalog scan in PostgresSchema#doReadIndexes.
• Fixed JsonSerDeser so the configured serType is respected.
• Fixed the schedule of ex-machina-start-unassigned-instances.
• Fixed a deadlock in the invalidation queue compute layer caused by Python code coverage running concurrently with py4j actions.
• Fixed Data Fusion so setCredentials no longer fails for SQL connectors using the Save & Test flow.
• Fixed Studio 8.10/8.11 Data Validation FK rule create/update against 8.9 environments so the selectedFKeysOnly and selectedFKeyNames fields are included.
• Fixed Cluster Autoscaler v1.35.0 upgrades by adding the missing RBAC for resource.k8s.io to the Helm chart.
• Fixed Data Fusion Production Mode so the graph no longer shows unconfigured nodes after updates to other nodes.
• Fixed Stories PDF generation failing with a 500 error.
• Fixed OpenSearch SSO so enabling SSO now disables basic auth.
• Patched setuptools path traversal (CVE-2025-47273) in c3-ai_c3.
• Patched CVE-2024-21538 (cross-spawn ReDoS) in c3-ai_c3.
• Patched CVE-2026-31802 (tar) in c3-ai_c3.
• Patched jaraco-context findings in the c3:8.10.0_46 base image.

Copy link to this section

8.10.4 Patch Notes

• Fixed Cluster Autoscaler v1.35.0 upgrades by adding the missing RBAC for resource.k8s.io to the Helm chart.
• Fixed ingress being removed for a second canonical after upgrade.
• Disabled AWS Calico by default to avoid conflicts on EKS clusters.
• Prevented GenaiCore.Llm.Completion.Client from writing LLM keys to logs.
• Fixed the schedule of ex-machina-start-unassigned-instances.
• Restored missing description text in the Cloud Message source collection modal and made confirmation banners consistent.
• Fixed Data Fusion so setCredentials no longer fails for SQL connectors when using the Save & Test flow.
• Fixed a KPI regression where template concurrent formatting ran 56–61% slower on release.
• Patched CVEs in the visual notebook runtime.
• Fixed Studio 8.10/8.11 Data Validation FK rule create/update against 8.9 environments; the selectedFKeysOnly and selectedFKeyNames fields are now included.
• Fixed incorrect event sequence numbers caused by per-app Pkg.Store.Seq use during UI bundle validation.
• Moved C3 type-system work (typed headers and ByteStream body) off the Vert.x event loop to reduce request latency.
• Remediated HIGH findings in the istio-pilot-discovery-fips-1.25 image (istio-pilot-fips:1.25.3-202506040304).
• Reduced the Cassandra boot disk size from 500 GB to 100 GB (Balanced persistent disk) in Terraform.
• Refreshed the Chainguard image for the VS Code browser experience.
• Fixed a curator-opensearch crashloop.
• Fixed a regression where SourceChunk#removeAll was failing.
• Fixed Data Fusion Transform Designer so a deleted entity name can be reused when defining a new target entity.
• Increased the default JupyterHub pod memory limit so user lab spawning no longer fails on OOMKilled.
• Fixed BA requests going through the OAuth client credential flow so VS Code Extension streaming no longer fails.
• Fixed the Data Fusion canvas so reconnecting through a Transform after Unlink/Remove of a source refreshes the graph correctly without a page reload.
• Fixed the Data Connector form so required-field error borders no longer persist across connectors after a failed Save and Test.
• Fixed Data Fusion so the graph no longer shows unconfigured nodes in Production Mode after updates to other nodes.
• Fixed Data Fusion so credentials can be updated for an existing Source System in Production Mode.
• Fixed an issue where changing a map field to an indexed map caused old data to be unreadable.
• Fixed Data Fusion so Sync Source Collection triggers on a single click without a page refresh.
• Updated the ERD banner notification to a less obtrusive presentation.
• Updated the Chainguard containerized Postgres image to address CVEs.
• Added a Data Validation rule to detect invalidation queue failures following pmf.
• Refreshed the ingress-nginx-controller-fips image to address 12 HIGH INFOSEC findings on 1.12.1.
• Remediated HIGH findings across 8.10 infrastructure components.
• Suppressed error banners on landing pages and polling APIs so transient issues no longer surface to users.
• Patched setuptools path traversal (CVE-2025-47273) in c3-ai_c3.
• Patched code-server for CVE-2026-41907.
• Patched openssl HIGH findings in the c3:8.10.0_46 base image.
• Patched jaraco-context HIGH findings in the c3:8.10.0_46 base image.
• Expanded VPC PrivateLink endpoints for GovCloud air-gapped deployments.
• Restored missing Data Validation advanced config wiring on support/v8.10.
• Patched HIGH findings in c3-jupyterlab:1.6.2.
• Prevented GitHub authentication tokens from being written in plaintext to OpenSearch logs.
• Fixed environment creation so a specified custom version is used instead of falling back to the default.
• Fixed data repair to handle the case where a series exists but the KV row for the measurement does not.
• Fixed spurious "Session timed out" errors in Notebook.
• Fixed a Codehaus Jackson CVE in c3vad.
• Fixed infinite loading in the SQL SourceCollection tables list.
• Enabled uploading CSVs larger than 2 GB.

Copy link to this section

8.10.2 Patch Notes

• Fixed multi-canonical setups so that accessing studio and c3 apps no longer fails.
• Fixed Cluster Bootstrap failures on 8.10 caused by StudioUIConfig initialization errors.
• Fixed an issue where artifacts could disappear from Studio.
• Hardened Studio so it no longer takes on additional load while already in a degraded state.
• Fixed applications getting stuck in an error state due to timeouts during application start.
• Fixed the Add Node Pool form in the service catalog so it loads correctly.
• Suppressed the node pool scaling warning banner while an Env or app is in the starting state.
• Fixed ExMachina canvas so it no longer throws CORS errors when the cluster is accessed via a vanity URL.
• Fixed the Data Fusion canvas so that Transform, SQLSource Collection, and Unconfigured Nodes are now hidden by the package filter.
• Implemented the Disable Async Processing toggle in Data Fusion global settings.
• Fixed an error when reading the mapr input field on a BigQuery source.
• Fixed Data Validation Advanced Settings so saved rule arguments remain visible when a Lambda rule's map or summarize function has errors.
• Exposed the valid job options for summarize-only Data Validation rules.
• Added support for changing certain fields of a seeded rule.
• Wired up advanced configuration to be applied to GenAI responses.
• Surfaced Jarvis build configuration values from <jarvisFilePath>/config/config.js in Studio even when the build is not in a running state.
• Added the ability to view test trends in Jarvis to help track test instability over time.
• Fixed the C3 Code coding agent so it can start using Azure Foundry when configured.
• Fixed metadata tagging failure when processing PSR data.
• Improved error reporting when GitHub pull operations fail in the workspace.
• Added context about the holding lock entry when database lock acquisition fails.
• Fixed Activity-Based Hibernation so the Static Console heartbeat no longer counts as user activity.
• Reduced latency of Translation#getTranslationForLocale.
• Fixed a StackOverflowError on FileSystem.listFiles and FileSystem.listDirs when a file name contained a narrow no-break space.
• Fixed a normalization migration race condition where concurrent execution could drop invalidated ranges.
• Fixed C3.pkg().fingerprint() so it returns a stable value across nodes and restarts, preventing upsertAllSeed from re-running on node restart.
• Improved server stability by isolating /metrics and /appmetrics scrape handling onto dedicated worker pools, preventing contention with the request path.
• Fixed an asynchronous package eviction deadlock between interpreter invalidation and Pkg.Store.
• Fixed orphan SeedData cleanup so it no longer deletes cross-package subtype records during App.upgrade.
• Fixed a bug in the upgradeSchema Cassandra config snapshot that seeded the configuration with the PLAT default instead of preserving the cluster's value.
• Patched multiple HIGH and CRITICAL CVEs across base images and components, including: tika-core (CRITICAL), jackson-core, spdystream, kernel-headers, google.golang.org/grpc, stdlib, libcrypto3, git-lfs, and openssl.
• Updated jupyterhub-k8s-hub-fips to the latest Chainguard image for upstream security fixes.
• Bumped the Chainguard base image to address HIGH CVEs in libssl3 and libcrypto3.

Copy link to this section

8.10.1 Known Common Vulnerabilities and Exposures (CVE)

C3 AI has accounted for all critical vulnerabilities and maintains a stringent internal patching policy. At this time, there are no critical vulnerabilities for C3 AI developed code. For open-source code vulnerabilities (CVEs), Critical and High issues are patched once fixes are available. In the interim, C3 AI provides mitigation remedies and statements as part of the patch notes. Vulnerabilities in open-source and third-party containers are remediated when new versions addressing the vulnerabilities are available and have been tested internally.

Copy link to this section

General CVEs

CVE ID	Problem Title	C3 AI Severity Rating	Mitigation Statement
CVE-2019-20920	Arbitrary Code Execution in Handlebars.	High	Expand Peripheral web application containers can be targeted for remote code execution. To reduce the risk of exploitation, the platform enforces de-privileged rights, RBAC, and seccomp profiles. Minimal interface exposure and runtime isolation limit the attack surface, while WAF and audit logging block and monitor for code injection attempts.
CVE-2023-2680	Incomplete fix for CVE-2021-3750 in qemu-kvm (RHEL 9.1 RHSA-2022:7967).	High	Expand Virtualization and hypervisor components can introduce Guest-to-Host escape or host-interaction risks if reachable and misconfigured. In typical C3 AI Platform deployments, affected components run in tightly bounded operational contexts rather than as broadly exposed internet services. The platform reduces exposure through Kubernetes workload isolation, network policies and firewall groups, least-privilege RBAC for cluster and node operations, seccomp and syscall restrictions where applicable, restricted administrative access to nodes and virtualization hosts, hardened images, and centralized audit logging to detect anomalous behavior affecting workloads or hosts.
CVE-2024-6519	Use-after-free in QEMU LSI53C895A SCSI HBA emulation enabling crash or VM escape.	High	Expand Buffer overflow vulnerabilities occur when a program writes more data to a memory buffer than it can accommodate, potentially overwriting adjacent memory regions. This can enable attackers to execute arbitrary code, crash services, or escalate privileges. In C3-built containers, such threats may stem from unsafe memory operations, unbounded input handling, or insufficient runtime protections. Mitigations: * Address Space Layout Randomization (ASLR) * Kernel-level stack and heap protections * RBAC restricting memory-sensitive operations * Input validation via C3 AI TypeSystem * Logical container isolation using NACLs and security groups * FIPS 140-2-compliant encryption * MFA for privileged accounts
CVE-2025-5914	Integer overflow in libarchive archive_read_format_rar_seek_data() leading to double-free.	High	Expand Buffer overflow vulnerabilities occur when a program writes more data to a memory buffer than it can accommodate, potentially overwriting adjacent memory regions. This can enable attackers to execute arbitrary code, crash services, or escalate privileges. In C3-built containers, such threats may stem from unsafe memory operations, unbounded input handling, or insufficient runtime protections. Mitigations: * Address Space Layout Randomization (ASLR) * Kernel-level stack and heap protections * RBAC restricting memory-sensitive operations * Input validation via C3 AI TypeSystem * Logical container isolation using NACLs and security groups * FIPS 140-2-compliant encryption * MFA for privileged accounts
CVE-2025-48734	Remote code execution via uncontrolled declaredClass access in Apache Commons BeanUtils.	High	Expand Privilege escalation in containerized environments occurs when attackers gain elevated access by exploiting weak access boundaries, misconfigured runtime settings, or overly permissive roles. While Chainguard containers are designed to minimize this threat, vulnerabilities may still arise if privilege scoping or isolation controls are improperly configured. Mitigations: * Scoped privileges and runtime isolation * RBAC and seccomp profiles enforcing least-privilege * Firewall group restrictions limiting lateral movement
CVE-2025-59375	Memory amplification in libexpat allowing denial-of-service via crafted XML.	High	Expand Denial-of-service vulnerabilities can degrade availability by exhausting CPU, memory, or bandwidth for dependent parsers and services. The C3 AI Platform mitigates resource exhaustion risks using ingress protections and firewall group restrictions where applicable, observability-backed alerting for abnormal traffic and memory growth, RBAC limiting who can influence sensitive workloads, strict TypeSystem validation at API boundaries to reject malformed payloads early, and operational patterns that limit parser interfaces and enforce reasonable request and payload constraints.
CVE-2025-68121	TLS session resumption flaw in Go crypto/tls when ClientCAs/RootCAs are mutated between handshakes.	High	Expand Unexpected TLS session or transport-layer behavior can undermine authentication or integrity expectations for affected components. To reduce spoofing and transport downgrade risks, the platform relies on encrypted communications with modern TLS configurations where applicable, network segmentation via firewall groups, layered validation at ingress including WAF where deployed, RBAC restricting changes to sensitive security settings, and comprehensive audit logging of security-relevant connection and administrative activity.
CVE-2026-3497	OpenSSH GSSAPI delta-patch flaw leading to undefined behavior during key exchange.	High	Expand Unexpected SSH protocol behavior during authentication or key exchange can contribute to instability or limited information exposure in vulnerable code paths. Administrative SSH access is constrained by network controls and security groups, configurations follow organizational hardening baselines, uncommon authentication mechanisms are disabled when not required, authentication events are centrally logged, and RBAC limits who may change SSH-exposed systems or platform networking.
CVE-2026-23949	Path traversal vulnerability in jaraco.context.	High	Expand File system tampering in peripheral containers can result in unauthorized modification or deletion of files. To reduce the risk of exploitation, the platform enforces RBAC, ACLs, and immutable file system configurations. Peripheral containers operate with limited privileges and are isolated from core platform resources. Audit logging and runtime integrity checks help detect and prevent unauthorized file modifications, while trusted package sources ensure only verified software is deployed.
CVE-2026-26740	Buffer overflow in giflib EGifGCBToExtension allowing remote denial-of-service.	High	Expand Buffer overflow vulnerabilities occur when a program writes more data to a memory buffer than it can accommodate, potentially overwriting adjacent memory regions. This can enable attackers to execute arbitrary code, crash services, or escalate privileges. In C3-built containers, such threats may stem from unsafe memory operations, unbounded input handling, or insufficient runtime protections. Mitigations: * Address Space Layout Randomization (ASLR) * Kernel-level stack and heap protections * RBAC restricting memory-sensitive operations * Input validation via C3 AI TypeSystem * Logical container isolation using NACLs and security groups * FIPS 140-2-compliant encryption * MFA for privileged accounts
CVE-2026-31938	HTML injection in jsPDF New Window paths.	High	Expand Remote code execution risks in Chainguard-based web applications can lead to unauthorized control over backend services. To reduce the risk of exploitation, the platform deploys minimal, distroless images with hardened configurations, enforces RBAC and seccomp profiles, and blocks injection and malformed requests using the WAF. Namespace isolation and firewall group restrictions contain runtime behavior, and audit logging ensures visibility into execution pathways.
GHSA-vjh7-7g9h-fjfh	Elliptic's private key extraction in ECDSA upon signing a malformed input.	High	Expand Exposure of cryptographic private keys or signing material can undermine confidentiality and authenticity for dependent operations. The C3 AI Platform mitigates key-material risks using strong access governance, RBAC for sensitive APIs, TypeSystem validation to block malformed inputs from reaching vulnerable call sites, encryption of secrets at rest and least-privilege secret access patterns, operational controls that prevent secret sprawl, comprehensive audit trails for cryptographic and administrative actions, and container isolation that constrains lateral movement toward sensitive workloads.

Copy link to this section

CVEs Applicable to MIS Only

Issue Severity	Problem Title	CVE	Mitigation Statement
High	Python-Multipart: Arbitrary file write via path traversal vulnerability	CVE-2026-24486	Expand Python-Multipart prior to 0.0.22 has a path-traversal vulnerability when using the non-default UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True configuration options. The issue only triggers under those non-default options; c3mis/vLLM usage via FastAPI request parsing is unlikely to use them, so exploitation risk in practice is low. Upgrading to python-multipart>=0.0.22 is still recommended.
High	vLLM RCE by torch.load in hf_model_weights_iterator	CVE-2025-24357	Expand vLLM's hf_model_weights_iterator used torch.load with weights_only=False, allowing arbitrary code execution when loading malicious pickle data from a HuggingFace checkpoint. Does not apply to c3mis — fixed upstream in vLLM 0.7.0, well before the c3mis-shipped 0.10.1.1.
High	Remote Code Execution in vLLM Multi-Node Cluster Configuration	CVE-2025-30165	Expand In multi-node vLLM deployments using the V0 engine, secondary hosts open a SUB ZeroMQ socket whose payload is deserialized with pickle, enabling RCE. Low risk for c3mis — c3mis uses single-node deployment, and the V1 engine has been default since vLLM 0.8.0. The vLLM maintainers have decided not to fix this issue; mitigation is environmental (run on a secure network if multi-node tensor parallelism is in use).
High	Data Exposure via ZeroMQ on Multi-Node vLLM Deployment	CVE-2025-30202	Expand In multi-node vLLM deployments the primary host binds an XPUB ZeroMQ socket to all interfaces, letting any network-reachable client subscribe and receive internal state — or stage a slow-consumer DoS. Does not apply to c3mis — fixed upstream in vLLM 0.8.5, before the c3mis-shipped 0.10.1.1.
High	HTTP header size limit not enforced allows Denial of Service from unauthenticated requests	CVE-2025-48956	Expand An unauthenticated DoS could be triggered by a single HTTP request with an extremely large header, exhausting server memory. Fixed upstream in vLLM 0.10.1.1 — the exact version c3mis ships, so c3mis is not exposed.
High	Timing Attack in vLLM API Token Verification Leading to Authentication Bypass	CVE-2025-59425	Expand vLLM's built-in API key validation used a non-constant-time string comparison vulnerable to timing analysis. Low risk for c3mis — c3mis does not use vLLM's HTTP API server directly; it uses the engine API (AsyncLLMEngine / LLM) within the C3 platform process. Fixed upstream in vLLM 0.11.0rc2.
High	vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs	CVE-2025-62372	Expand Passing multimodal embedding inputs with the correct ndim but an incorrect shape (e.g. wrong hidden dimension) crashes the vLLM engine. Applies to c3mis — c3mis supports multimodal inputs via extractMultiModalData. Fixed upstream in vLLM 0.11.1; an upgrade is required for the fix.
High	Server-Side Request Forgery (SSRF) in MediaConnector	CVE-2025-6242	Expand MediaConnector.load_from_url / load_from_url_async fetch user-supplied URLs without restricting target hosts, enabling SSRF into internal networks. Low risk for c3mis — c3mis passes multimodal data directly via parameters rather than URLs through MediaConnector. Unfixed upstream as of this writing.
High	vLLM: Remote Code Execution via malicious model configuration	CVE-2025-66448	Expand The Nemotron_Nano_VL_Config class resolves auto_map entries via get_class_from_dynamic_module and instantiates the returned class even when trust_remote_code=False. Applies to c3mis — c3mis passes trust_remote_code=True in engine args, so loading an untrusted model is exploitable. Fixed upstream in vLLM 0.11.1.
High	vLLM: Server-Side Request Forgery allows internal network access	CVE-2026-24779	Expand MediaConnector uses two Python parsing libraries that interpret backslashes differently, allowing the hostname restriction to be bypassed and enabling SSRF into internal networks. Low risk for c3mis — c3mis does not use MediaConnector URL loading. Fixed upstream in vLLM 0.14.1.
High	vLLM: Arbitrary code execution via untrusted model loading	CVE-2026-22807	Expand vLLM versions 0.10.1 through 0.13.x load HuggingFace auto_map dynamic modules during model resolution without gating on trust_remote_code. Applies to c3mis — affected version range overlaps with c3mis. If an attacker controls the model repo/path, arbitrary Python executes during model load, before any request handling. Fixed upstream in vLLM 0.14.0.
High	vLLM: Remote code execution due to hardcoded trust_remote_code setting	CVE-2026-27893	Expand Two model implementations in vLLM 0.10.1 through 0.17.x hardcode trust_remote_code=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False opt-out. Applies to c3mis — affected versions match c3mis's range; the bypass affects specific model implementations. Fixed upstream in vLLM 0.18.0.
High	jaraco.context: Path traversal via malicious tar archives	CVE-2026-23949	Expand jaraco.context.tarball() versions 5.2.0 through 6.0.x are vulnerable to Zip Slip path traversal, including nested-tarball variants. jaraco.context==5.3.0 is not a direct or transitive dependency of c3mis — it is vendored inside setuptools and is only invoked when setuptools extracts tarballs (e.g. during pip install from sdists). Exploitation would require an attacker to supply a malicious tarball during a pip install in the runtime environment, which is unlikely in a deployed MIS environment. Recommended fix: upgrade setuptools to a version that vendors jaraco.context>=6.1.0, or add jaraco.context>=6.1.0 as a standalone pip dependency to override the vendored copy.