“TorchServe’s documentation claims that the default management API can be accessed only from localhost by default.”
The management API actually binds to 0.0.0.0 with no authentication, and an SSRF rated 9.8 on that API leads to remote code execution. Meta and Amazon maintain TorchServe, which pulls over 30,000 PyPI downloads a month. Oligo found tens of thousands of exposed instances, including Fortune 500 companies. Everyone wants AI safety frameworks and nobody checked which address the model server listens on.