GCVE-110-VULN-PYPI-2026-000641

If you run aimarket-metis without METIS_API_KEY behind a reverse proxy, tunnel or port forward on the same host, and that proxy runs as the same user as the server or the host is not Linux, every caller of the proxy can run verifications (POST /v1/verify, /v1/verify/stream, /aimarket/invoke) that spend your model budget. A keyless server answers only callers it judges local (metis.api.auth.local_caller). The test added in 0.2.3 (metis.api.auth._caller_is_this_user) tells a proxy from a local client only by the owner of its socket in /proc/net/tcp: a proxy running as the server's user passes it, and where /proc/net/tcp does not exist (macOS, Windows) every caller passes it. Earlier versions are exposed to the same proxy as well (GCVE-110-VULN-PYPI-2026-000613). 0.2.4 does not change it. Affects 0.2.0 through 0.2.4.