A remote attacker can exploit a flaw in Tencent AI-Infra-Guard 4.0 by manipulating an unknown function within the Task Detail Endpoint, specifically the task_manager.go module. This manipulation allows the attacker to read sensitive data that should be protected, exposing internal configurations, identifiers, or other confidential information. The weakness is classified as Information Exposure (CWE-200) coupled with Improper Access Control (CWE-284).

All deployments of Tencent AI-Infra-Guard version 4.0 that expose the Task Detail Endpoint are vulnerable. The issue resides in the common/websocket/task_manager.go file and affects the endpoint that returns detailed information about tasks managed by the system. No other versions or components are listed as impacted.

The CVSS base score of 6.9 indicates a moderate to high risk level. Although EPSS data is not provided, the vulnerability has a public exploit and could be triggered remotely without requiring local credentials. The attack vector is inferred to be remote via HTTP(S) traffic targeting the unsecured endpoint. The vulnerability is not currently listed in the CISA KEV catalog, but the presence of a public exploit raises the likelihood of real-world compromise.