AI Threat AlertCVE-2026-105754: vLLM: input validation flaws let attacker crash EngineCore
GHSA-ph72-cqr5-qpp7MEDIUMA flaw in vLLM's disaggregated /inference/v1/generate endpoint trusts caller-supplied multimodal tensors, cache hashes and placeholder ranges without validating them against the active model, so an authenticated low-privilege user can crash the shared EngineCore and take down inference for every tenant. It can also poison or read cross-request encoder-cache state if the attacker knows or can induce a victim's content hash. The CVSS of 6.5 is moderate and there is no KEV listing, public exploit or Nuclei template. EPSS is low at 0.27% (82nd percentile), but vLLM has 95 downstream dependents and 123 other CVEs on record, and a shared serving engine makes the availability impact wider than the score suggests. Upgrade to vLLM 0.30.0 and restrict access to the disaggregated generate endpoint to trusted internal services.
What is the risk?
Medium overall. Exploitation is low-complexity over the network and needs only low privileges and no user interaction. The main impact is availability (A:H), because one malformed request can terminate the shared EngineCore. The cache-hash forgery adds a secondary confidentiality and integrity risk that is not reflected in the CVSS vector, and it needs knowledge of a victim's content hash. Exposure is highest in multi-tenant or scale-out deployments where the endpoint is reachable by untrusted clients. Exploitation likelihood is low today (EPSS 0.27%, no public exploit, not in KEV), but the attack is simple once the request format is understood.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | < 0.30.0 | 0.30.0 |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade vLLM to 0.30.0 or later (fix in PR #51898). 2) If you cannot patch immediately, block external access to /inference/v1/generate and keep it reachable only from trusted internal components, using network policy, mTLS or an authenticated gateway. 3) Have the gateway reject client-supplied features.kwargs_data, mm_hashes and mm_placeholders fields. 4) Apply per-tenant rate limiting and enforce authentication on all serving endpoints. 5) Monitor for unexpected EngineCore terminations and restarts, repeated 4xx/5xx errors on the endpoint, and requests with unusually large or malformed multimodal feature payloads. 6) Use a supervisor or orchestrator to restart crashed engine processes automatically, and isolate tenants onto separate engine instances where feasible.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-105754?
A flaw in vLLM's disaggregated /inference/v1/generate endpoint trusts caller-supplied multimodal tensors, cache hashes and placeholder ranges without validating them against the active model, so an authenticated low-privilege user can crash the shared EngineCore and take down inference for every tenant. It can also poison or read cross-request encoder-cache state if the attacker knows or can induce a victim's content hash. The CVSS of 6.5 is moderate and there is no KEV listing, public exploit or Nuclei template. EPSS is low at 0.27% (82nd percentile), but vLLM has 95 downstream dependents and 123 other CVEs on record, and a shared serving engine makes the availability impact wider than the score suggests. Upgrade to vLLM 0.30.0 and restrict access to the disaggregated generate endpoint to trusted internal services.
Is CVE-2026-105754 actively exploited?
No confirmed active exploitation of CVE-2026-105754 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-105754?
1) Upgrade vLLM to 0.30.0 or later (fix in PR #51898). 2) If you cannot patch immediately, block external access to /inference/v1/generate and keep it reachable only from trusted internal components, using network policy, mTLS or an authenticated gateway. 3) Have the gateway reject client-supplied features.kwargs_data, mm_hashes and mm_placeholders fields. 4) Apply per-tenant rate limiting and enforce authentication on all serving endpoints. 5) Monitor for unexpected EngineCore terminations and restarts, repeated 4xx/5xx errors on the endpoint, and requests with unusually large or malformed multimodal feature payloads. 6) Use a supervisor or orchestrator to restart crashed engine processes automatically, and isolate tenants onto separate engine instances where feasible.
What systems are affected by CVE-2026-105754?
This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, multimodal inference, disaggregated/scale-out serving, multi-tenant AI platforms.
What is the CVSS score for CVE-2026-105754?
CVE-2026-105754 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.27%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0040AI Model Inference API AccessAML.T0043Craft Adversarial DataAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0.
Exploitation Scenario
An attacker with a low-privilege API account on a multi-tenant vLLM scale-out deployment sends a crafted request to /inference/v1/generate with forged grid geometry or a non-positive placeholder length in features.mm_placeholders. The shared EngineCore hits a reachable assertion and terminates, causing an outage for all tenants. By repeating the request after each restart, the attacker keeps the service down. In a variant, the attacker submits a forged mm_hashes value matching a known image or document hash to poison the encoder cache, causing another user's multimodal request to be processed with attacker-controlled embeddings.
Weaknesses (CWE)
CWE-1284Improper Validation of Specified Quantity in InputPrimaryCWE-1284Improper Validation of Specified Quantity in InputPrimaryCWE-20Improper Input ValidationPrimaryCWE-20Improper Input ValidationPrimaryCWE-617Reachable AssertionPrimaryCWE-617Reachable AssertionPrimaryCWE-639Authorization Bypass Through User-Controlled KeyPrimaryCWE-639Authorization Bypass Through User-Controlled KeyPrimaryCWE-668Exposure of Resource to Wrong SpherePrimaryCWE-668Exposure of Resource to Wrong SpherePrimaryCWE-704Incorrect Type Conversion or CastPrimaryCWE-704Incorrect Type Conversion or CastPrimaryCWE-1284Improper Validation of Specified Quantity in InputCWE-20Improper Input ValidationCWE-617Reachable AssertionCWE-639Authorization Bypass Through User-Controlled KeyCWE-668Exposure of Resource to Wrong SphereCWE-704Incorrect Type Conversion or CastCWE-1284 — Improper Validation of Specified Quantity in Input: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm