CVE-2026-114049: vLLM stale token mask leaks across

CISO Take

vLLM before 0.31.0 has a batch-management flaw in InputBatch.condense() that leaves stale allowed_token_ids rows behind, so one client's token allowlist can be silently applied to a different client's unrestricted request. An attacker who can send concurrent constrained generation requests, including through the unauthenticated /invocations endpoint, can distort other users' outputs. The risk is low: CVSS is 3.7, attack complexity is high, the impact is limited to output integrity (no confidentiality or availability loss), and there is no KEV listing, public exploit or Nuclei template. EPSS and downstream dependent data are unavailable, so exploitation likelihood is unquantified. The practical concern is for shared, multi-tenant inference endpoints where corrupted outputs could feed downstream decisions or automation. Upgrade to vLLM 0.31.0 or later, and restrict network access to /invocations and other inference endpoints to authenticated clients.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Low overall (CVSS 3.7). The attack is network-reachable with no privileges or user interaction, but it depends on race-like timing of batch slot recycling (high complexity) and is non-deterministic. Impact is limited to integrity of model outputs for co-tenants. Risk rises for multi-tenant or internet-exposed vLLM deployments that use structured or constrained decoding, and for pipelines that trust model output without validation. No known active exploitation, public exploit or scanner template exists.

How does the attack unfold?

Initial Access

Attacker reaches the vLLM server, including the unauthenticated /invocations endpoint, over the network.

AML.T0040

Exploitation

Attacker submits concurrent constrained generate requests with allowed_token_ids so condense() leaves stale mask rows in recycled batch slots.

AML.T0049

Impact

Victims' unrestricted requests inherit the stale allowlist, corrupting or steering their outputs.

AML.T0031

Initial Access

Attacker reaches the vLLM server, including the unauthenticated /invocations endpoint, over the network.

AML.T0040

Exploitation

Attacker submits concurrent constrained generate requests with allowed_token_ids so condense() leaves stale mask rows in recycled batch slots.

AML.T0049

Impact

Victims' unrestricted requests inherit the stale allowlist, corrupting or steering their outputs.

AML.T0031

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

1) Upgrade vLLM to 0.31.0 or later. 2) Until patched, put /invocations and other inference endpoints behind authentication and network controls (API gateway, mTLS, private network). 3) Isolate tenants onto separate vLLM instances if shared serving is not required, or disable or block client-supplied allowed_token_ids and constrained-decoding parameters at the gateway. 4) Validate and schema-check model outputs before downstream use. 5) Monitor for unusual volumes of concurrent requests carrying allowed_token_ids and for anomalous or truncated outputs reported by users.

How is it classified?

Data LeakageInferenceAPIAML.T0031- Erode AI Model Integrity AML.T0040- AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and system failures

OWASP LLM Top 10

LLM03-Supply Chain / Vulnerable Components

Frequently Asked Questions

What is CVE-2026-114049?

vLLM before 0.31.0 has a batch-management flaw in InputBatch.condense() that leaves stale allowed_token_ids rows behind, so one client's token allowlist can be silently applied to a different client's unrestricted request. An attacker who can send concurrent constrained generation requests, including through the unauthenticated /invocations endpoint, can distort other users' outputs. The risk is low: CVSS is 3.7, attack complexity is high, the impact is limited to output integrity (no confidentiality or availability loss), and there is no KEV listing, public exploit or Nuclei template. EPSS and downstream dependent data are unavailable, so exploitation likelihood is unquantified. The practical concern is for shared, multi-tenant inference endpoints where corrupted outputs could feed downstream decisions or automation. Upgrade to vLLM 0.31.0 or later, and restrict network access to /invocations and other inference endpoints to authenticated clients.

Is CVE-2026-114049 actively exploited?

No confirmed active exploitation of CVE-2026-114049 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114049?

1) Upgrade vLLM to 0.31.0 or later. 2) Until patched, put /invocations and other inference endpoints behind authentication and network controls (API gateway, mTLS, private network). 3) Isolate tenants onto separate vLLM instances if shared serving is not required, or disable or block client-supplied allowed_token_ids and constrained-decoding parameters at the gateway. 4) Validate and schema-check model outputs before downstream use. 5) Monitor for unusual volumes of concurrent requests carrying allowed_token_ids and for anomalous or truncated outputs reported by users.

What systems are affected by CVE-2026-114049?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, multi-tenant inference APIs, agent frameworks consuming inference output.

What is the CVSS score for CVE-2026-114049?

CVE-2026-114049 has a CVSS v3.1 base score of 3.7 (LOW). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference serversmulti-tenant inference APIsagent frameworks consuming inference output

MITRE ATLAS Techniques

AML.T0031Erode AI Model Integrity

AML.T0040AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.

Exploitation Scenario

An attacker finds an exposed vLLM server with an unauthenticated /invocations endpoint shared by several applications. They send many concurrent generation requests with a narrow allowed_token_ids list, so batch slots are repeatedly condensed and recycled. Stale mask rows remain attached to recycled slots, and legitimate users' unrestricted requests that land in those slots are forced to draw only from the attacker's token allowlist. This yields degraded, wrong or attacker-influenced outputs, for example forcing a classifier or agent step toward a specific answer.