Is there a public PoC exploit available for CVE-2026-5585?

Yes, a public proof-of-concept exploit is available for CVE-2026-5585. Prioritise patching immediately. EPSS: 0.0%.

Ai Infra Guard CVE-2026-5585

Q: What is the CVSS score of CVE-2026-5585?

CVE-2026-5585 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19115 MEDIUM

Information Exposure (CWE-200)

2026-04-05 VulDB

Information Disclosure Ai Infra Guard Tencent

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 18:00 euvd

EUVD-2026-19115

Analysis Generated

Apr 05, 2026 - 18:00 vuln.today

CVE Published

Apr 05, 2026 - 17:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Tencent AI-Infra-Guard 4.0 discloses sensitive information through an unknown function in the Task Detail Endpoint (common/websocket/task_manager.go) that can be manipulated by remote, unauthenticated attackers. The vulnerability has a CVSS score of 5.5 with publicly available exploit code, though no patch has been released despite early vendor notification.

Technical ContextAI

The vulnerability exists in the WebSocket task management component of Tencent AI-Infra-Guard, specifically within the Task Detail Endpoint handler. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper access controls or data validation in the task_manager.go file. The vulnerability affects version 4.0 and potentially earlier versions based on the CPE wildcard pattern. The WebSocket protocol is used for task communication, and the manipulation of an unknown function within this endpoint allows attackers to access information that should be restricted.

RemediationAI

No vendor-released patch has been identified as of this analysis. Users should implement network-level access controls to restrict remote access to the WebSocket Task Detail Endpoint (common/websocket/task_manager.go) if possible. Monitor Tencent's official security advisories for patch releases, though the vendor's non-response suggests remediation timeline is unclear. As an interim measure, disable or isolate the Task Detail Endpoint if not required for critical operations, and implement authentication or IP whitelisting at the network boundary to restrict access to trusted sources only.