CVE-2026-105756: vLLM unvalidated cache_salt

Q: Is CVE-2026-105756 actively exploited?

No confirmed active exploitation of CVE-2026-105756 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-105756?

1) Upgrade vLLM to 0.30.0 or later (fix in PR 51444, commit e962733). 2) If you cannot patch immediately, validate cache_salt at a reverse proxy or API gateway: restrict it to the character set and length LMCache-MP accepts, or strip the field from untrusted clients. 3) Restrict the OpenAI-compatible endpoint to authenticated, trusted clients and apply per-tenant rate limits. 4) Run vLLM under a supervisor with automatic restart and health checks to shorten outage windows. 5) Detect by alerting on EngineCore termination, ValueError tracebacks in scheduler cache lookup, and unusual cache_salt values in request logs. 6) Inventory deployments to confirm whether LMCache-MP is in use and prioritise those.

Q: What systems are affected by CVE-2026-105756?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference gateways, multi-tenant LLM platforms, KV cache sharing deployments.

Q: What is the CVSS score for CVE-2026-105756?

CVE-2026-105756 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.33%.

CISO Take

vLLM versions before 0.30.0 accept any non-empty cache_salt in OpenAI-compatible requests without enforcing the character and length limits that LMCache-MP expects, so a malformed salt triggers an uncaught ValueError that terminates EngineCore and takes down inference for every concurrent user. Only deployments using the LMCache-MP connector are exposed, but for those the attack needs just a single authenticated, low-privilege API call over the network with no user interaction. Exploitation likelihood is modest (EPSS 0.00312, top 78th percentile), the flaw is not in CISA KEV, and there is no public exploit or Nuclei template, so this is a availability risk rather than a data-breach risk. With 95 downstream dependents and 134 other CVEs in the vllm package, the blast radius for shared or multi-tenant LLM serving is meaningful. Upgrade to vLLM 0.30.0 or later, and until then validate or strip cache_salt at your API gateway and alert on unexpected EngineCore restarts.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Medium risk (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N, A:H only). Exploitation is trivial for anyone holding a valid API credential, and one request can crash the engine. There is no confidentiality or integrity impact. Likelihood of in-the-wild exploitation is low (EPSS 0.00312, no KEV listing, no public PoC, no scanner template). Real exposure is limited to deployments that use the LMCache-MP connector and expose the OpenAI-compatible API to untrusted or semi-trusted tenants, where one user can deny service to all others.

How does the attack unfold?

Initial Access

Attacker uses a valid low-privilege API key to reach the vLLM OpenAI-compatible endpoint.

AML.T0040

Exploitation

Attacker submits a request with a cache_salt containing a forbidden character or excess length, which bypasses validation.

AML.T0049

Crash

The LMCache-MP IPCCacheServerKey consumer raises an uncaught ValueError during scheduler cache lookup, terminating EngineCore.

Impact

All concurrent users lose inference service until restart, and repeated requests sustain the outage.

AML.T0029

Initial Access

Attacker uses a valid low-privilege API key to reach the vLLM OpenAI-compatible endpoint.

AML.T0040

Exploitation

Attacker submits a request with a cache_salt containing a forbidden character or excess length, which bypasses validation.

AML.T0049

Crash

The LMCache-MP IPCCacheServerKey consumer raises an uncaught ValueError during scheduler cache lookup, terminating EngineCore.

Impact

All concurrent users lose inference service until restart, and repeated requests sustain the outage.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.30.0	`0.30.0`
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade vLLM to 0.30.0 or later (fix in PR 51444, commit e962733). 2) If you cannot patch immediately, validate cache_salt at a reverse proxy or API gateway: restrict it to the character set and length LMCache-MP accepts, or strip the field from untrusted clients. 3) Restrict the OpenAI-compatible endpoint to authenticated, trusted clients and apply per-tenant rate limits. 4) Run vLLM under a supervisor with automatic restart and health checks to shorten outage windows. 5) Detect by alerting on EngineCore termination, ValueError tracebacks in scheduler cache lookup, and unusual cache_salt values in request logs. 6) Inventory deployments to confirm whether LMCache-MP is in use and prioritise those.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-105756?

vLLM versions before 0.30.0 accept any non-empty cache_salt in OpenAI-compatible requests without enforcing the character and length limits that LMCache-MP expects, so a malformed salt triggers an uncaught ValueError that terminates EngineCore and takes down inference for every concurrent user. Only deployments using the LMCache-MP connector are exposed, but for those the attack needs just a single authenticated, low-privilege API call over the network with no user interaction. Exploitation likelihood is modest (EPSS 0.00312, top 78th percentile), the flaw is not in CISA KEV, and there is no public exploit or Nuclei template, so this is a availability risk rather than a data-breach risk. With 95 downstream dependents and 134 other CVEs in the vllm package, the blast radius for shared or multi-tenant LLM serving is meaningful. Upgrade to vLLM 0.30.0 or later, and until then validate or strip cache_salt at your API gateway and alert on unexpected EngineCore restarts.

Is CVE-2026-105756 actively exploited?

No confirmed active exploitation of CVE-2026-105756 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105756?

1) Upgrade vLLM to 0.30.0 or later (fix in PR 51444, commit e962733). 2) If you cannot patch immediately, validate cache_salt at a reverse proxy or API gateway: restrict it to the character set and length LMCache-MP accepts, or strip the field from untrusted clients. 3) Restrict the OpenAI-compatible endpoint to authenticated, trusted clients and apply per-tenant rate limits. 4) Run vLLM under a supervisor with automatic restart and health checks to shorten outage windows. 5) Detect by alerting on EngineCore termination, ValueError tracebacks in scheduler cache lookup, and unusual cache_salt values in request logs. 6) Inventory deployments to confirm whether LMCache-MP is in use and prioritise those.

What systems are affected by CVE-2026-105756?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference gateways, multi-tenant LLM platforms, KV cache sharing deployments.

What is the CVSS score for CVE-2026-105756?

CVE-2026-105756 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference gatewaysmulti-tenant LLM platformsKV cache sharing deployments

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.

Exploitation Scenario

An attacker or malicious tenant with a low-privilege API key for a shared vLLM-backed LLM service sends a chat or completion request to the OpenAI-compatible endpoint with a cache_salt that contains a forbidden character or exceeds the permitted length. The server accepts the value, and during scheduler cache lookup the LMCache-MP IPCCacheServerKey consumer raises an uncaught ValueError. EngineCore terminates, dropping all concurrent users' requests. The attacker repeats the request after each restart to keep the service down.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-20Improper Input ValidationPrimary CWE-248Uncaught ExceptionPrimary CWE-248Uncaught ExceptionPrimary CWE-20Improper Input Validation CWE-248Uncaught Exception

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.