CVE-2026-105755: vLLM request-ID cache key

Q: Is CVE-2026-105755 actively exploited?

No confirmed active exploitation of CVE-2026-105755 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-105755?

1) Upgrade vllm (pip) to 0.30.0 or later (fix in PR #51445, commit ee17d0d). 2) As a workaround, put vLLM behind a gateway or reverse proxy that strips any client-supplied X-Request-Id and generates a unique server-side ID (e.g. UUIDv4) per request. 3) Restrict access to /score and /rerank to trusted clients and apply per-tenant authentication and rate limits. 4) Do not share one vLLM instance across trust boundaries for late-interaction scoring until it is patched. 5) Detection: alert on repeated or colliding X-Request-Id values from different clients or API keys, and on spikes of late-interaction cache-miss errors in vLLM logs. 6) Review GHSA-2phq-3phc-84px for the full advisory and inventory vllm versions across your environments.

Q: What systems are affected by CVE-2026-105755?

This vulnerability affects the following AI/ML architecture patterns: Model serving, RAG pipelines, Reranking and semantic search services, Multi-tenant LLM inference gateways.

Q: What is the CVSS score for CVE-2026-105755?

CVE-2026-105755 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.20%.

CISO Take

vLLM versions before 0.30.0 build the late-interaction query cache key from the caller-controlled X-Request-Id header on the /score and /rerank endpoints. An authenticated user who reuses another user's request ID can overwrite the cached query embedding, so the victim's documents are scored against the attacker's query. This silently corrupts ranking results and can also trigger cache-miss errors. Risk is moderate: CVSS is 4.2 (high attack complexity, low privileges required), and EPSS is 0.2%, which still puts it in the top 91% percentile. It is not in CISA KEV, and there is no public exploit or Nuclei template. Blast radius is notable, though: vllm has 95 downstream dependents and 124 other CVEs on record, and any RAG or search stack that reranks with vLLM is exposed. Upgrade to vLLM 0.30.0 and make sure your gateway sets or overwrites X-Request-Id instead of passing through client values.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Medium. Exploitation needs network access and a valid low-privilege account (PR:L). Complexity is high because the attacker must hit the same request ID while a victim request is in flight (a race). Confidentiality impact is none; integrity and availability impacts are low. The EPSS is low (0.00204), there is no KEV listing and no public exploit. Exposure grows in multi-tenant vLLM deployments that serve /score and /rerank to several users or applications, since they share one cache namespace. Single-tenant or internal-only deployments carry minimal risk.

How does the attack unfold?

Initial Access

Attacker with a low-privilege account reaches the exposed vLLM /score or /rerank endpoint and learns or guesses a victim's X-Request-Id.

AML.T0040

Exploitation

Attacker sends a concurrent request reusing the victim's X-Request-Id, so the caller-controlled query_key collides and overwrites the cached query embedding.

AML.T0049

Impact

The victim's documents are scored against the attacker's query, or shared counters cause cache-miss errors, corrupting rankings and degrading availability.

AML.T0031

Initial Access

Attacker with a low-privilege account reaches the exposed vLLM /score or /rerank endpoint and learns or guesses a victim's X-Request-Id.

AML.T0040

Exploitation

Attacker sends a concurrent request reusing the victim's X-Request-Id, so the caller-controlled query_key collides and overwrites the cached query embedding.

AML.T0049

Impact

The victim's documents are scored against the attacker's query, or shared counters cause cache-miss errors, corrupting rankings and degrading availability.

AML.T0031

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.30.0	`0.30.0`
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

4.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CNone

ILow

ALow

What should I do?

1 step

1) Upgrade vllm (pip) to 0.30.0 or later (fix in PR #51445, commit ee17d0d). 2) As a workaround, put vLLM behind a gateway or reverse proxy that strips any client-supplied X-Request-Id and generates a unique server-side ID (e.g. UUIDv4) per request. 3) Restrict access to /score and /rerank to trusted clients and apply per-tenant authentication and rate limits. 4) Do not share one vLLM instance across trust boundaries for late-interaction scoring until it is patched. 5) Detection: alert on repeated or colliding X-Request-Id values from different clients or API keys, and on spikes of late-interaction cache-miss errors in vLLM logs. 6) Review GHSA-2phq-3phc-84px for the full advisory and inventory vllm versions across your environments.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassDoSInferenceAPIRAGAML.T0029- Denial of AI Service AML.T0031- Erode AI Model Integrity AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated

OWASP LLM Top 10

LLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-105755?

vLLM versions before 0.30.0 build the late-interaction query cache key from the caller-controlled X-Request-Id header on the /score and /rerank endpoints. An authenticated user who reuses another user's request ID can overwrite the cached query embedding, so the victim's documents are scored against the attacker's query. This silently corrupts ranking results and can also trigger cache-miss errors. Risk is moderate: CVSS is 4.2 (high attack complexity, low privileges required), and EPSS is 0.2%, which still puts it in the top 91% percentile. It is not in CISA KEV, and there is no public exploit or Nuclei template. Blast radius is notable, though: vllm has 95 downstream dependents and 124 other CVEs on record, and any RAG or search stack that reranks with vLLM is exposed. Upgrade to vLLM 0.30.0 and make sure your gateway sets or overwrites X-Request-Id instead of passing through client values.

Is CVE-2026-105755 actively exploited?

No confirmed active exploitation of CVE-2026-105755 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105755?

1) Upgrade vllm (pip) to 0.30.0 or later (fix in PR #51445, commit ee17d0d). 2) As a workaround, put vLLM behind a gateway or reverse proxy that strips any client-supplied X-Request-Id and generates a unique server-side ID (e.g. UUIDv4) per request. 3) Restrict access to /score and /rerank to trusted clients and apply per-tenant authentication and rate limits. 4) Do not share one vLLM instance across trust boundaries for late-interaction scoring until it is patched. 5) Detection: alert on repeated or colliding X-Request-Id values from different clients or API keys, and on spikes of late-interaction cache-miss errors in vLLM logs. 6) Review GHSA-2phq-3phc-84px for the full advisory and inventory vllm versions across your environments.

What systems are affected by CVE-2026-105755?

This vulnerability affects the following AI/ML architecture patterns: Model serving, RAG pipelines, Reranking and semantic search services, Multi-tenant LLM inference gateways.

What is the CVSS score for CVE-2026-105755?

CVE-2026-105755 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

Model servingRAG pipelinesReranking and semantic search servicesMulti-tenant LLM inference gateways

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0031Erode AI Model Integrity

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.

Exploitation Scenario

A low-privileged user of a shared internal RAG platform backed by a vLLM reranker learns or guesses a colleague's request ID (for example from logs, tracing headers or a predictable pattern). While the colleague's /rerank call is processing, the attacker sends a concurrent request with the same X-Request-Id and a crafted query. The cached query embedding is overwritten, so the victim's candidate documents are scored against the attacker's query. The victim's application gets a wrong ranking, or a cache-miss error, and passes manipulated context to the LLM or to the user.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.