GCVE-110-VULN-PYPI-2026-000613

aimarket-metis 0.2.0 and 0.2.1 skip authentication on POST /v1/verify, /v1/verify/stream and /aimarket/invoke (metis.api.auth.verify_api_key) and on the coordinator server (metis.coordinator_server) when METIS_API_KEY is unset and production mode is off, which is the default. The server binds 0.0.0.0 by default (metis serve --host), so anyone who can reach the port can run verifications that spend the operator's model budget. 0.2.2 answers only callers it judges local (a loopback peer and Host, no forwarding header, no cross-site Origin), but a reverse proxy on the same host passes that test, because nginx's default proxy_pass connects from 127.0.0.1 and sends a loopback Host, so every caller of a keyless server behind it was still served. Fixed in 0.2.3, which on Linux also requires the caller's socket to belong to the server's user. Set METIS_API_KEY behind any reverse proxy. Affects 0.2.0 through 0.2.2.