CVE-2026-5585

CVE-2026-5585 is an information disclosure vulnerability identified in Tencent AI-Infra-Guard version 4.0, specifically within the Task Detail Endpoint component located in the common/websocket/task_manager.go file. The vulnerability allows unauthorized access to sensitive information through an unknown function within this component. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no special privileges or user interaction, making it accessible to remote attackers. However, the impact is limited to confidentiality concerns, with no effects on system integrity or availability. The attack is relatively straightforward to execute given its low complexity rating. Regarding exploitation status, while proof-of-concept code has been made publicly available, there is currently no evidence of active exploitation in the wild, as indicated by its absence from CISA's Known Exploited Vulnerabilities catalog. Community attention remains minimal, reflected in the low EPSS score of 0.00012, suggesting this vulnerability poses a lower risk compared to the broader CVE landscape. Notably, the vendor has not responded to early disclosure communications regarding this issue.