---
title: Tip: self-hosting Xinference? Upgrading to 4.0.1 isn't enough — set one shared XOSCAR_AUTH_KEY and firewall actor ports | ctxsec
url: https://ctxsec.com/items/tip-xinference-actor-auth
description: ""
status: "tip (project guidance)"
published: 2026-10-17
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-xinference-actor-auth.md)

tip (project guidance)

2026-10-17

### Tip: self-hosting Xinference? Upgrading to 4.0.1 isn't enough — set one shared XOSCAR_AUTH_KEY and firewall actor ports

Generate one random secret per deployment, set it as XOSCAR_AUTH_KEY on the supervisor, every worker and any direct actor client, then restart them together (keyed and unkeyed peers can't talk). Keep actor ports reachable only by cluster peers, never from user subnets, and don't count an HTTP API token as protection.

Sources: [VulnCheck](https://www.vulncheck.com/blog/xorbits-xoscar-unauth-cloudpickle-rce) · [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-49950) · [Xinference 4.0.1 release](https://github.com/xorbitsai/inference/releases/tag/v4.0.1)