CVE-2026-115912: vLLM pickle deserialization RCE

Q: Is CVE-2026-115912 actively exploited?

No confirmed active exploitation of CVE-2026-115912 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115912?

1) Upgrade vLLM to 0.32.0 or later (fix in PR 59357 and the linked commit; see GHSA-6757-hggm-hp2w). 2) If patching is delayed, disable shared-memory multimodal caching in scale-out deployments or run single-process serving. 3) Restrict the inference API to trusted callers behind authentication, network segmentation, and an API gateway; rotate and scope API keys. 4) Run workers with least privilege, in containers with no unneeded cloud credentials, read-only filesystems, and egress filtering. 5) Detect: alert on requests whose multimodal features.kwargs_data contains unexpected shared-memory address or monotonic_id fields, and on worker processes spawning shells, making unexpected outbound connections, or reading credential files. 6) Inventory vLLM versions via SBOM and container scanning.

Q: What systems are affected by CVE-2026-115912?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, multimodal inference pipelines, distributed scale-out inference, multi-tenant inference gateways.

Q: What is the CVSS score for CVE-2026-115912?

CVE-2026-115912 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.51%.

CISO Take

CVE-2026-115912 is an insecure deserialization flaw in vLLM's shared-memory multimodal cache: an authenticated caller can forge shared-memory address and monotonic_id values so that workers pass attacker-chosen bytes to pickle.loads(), yielding arbitrary Python execution even when insecure serialization is disabled. The CVSS score of 7.5 is held down by high attack complexity and the need for low-privilege credentials, but the impact is full compromise of inference workers that typically hold GPUs, model weights, and cloud credentials. There is no KEV listing, no public exploit, no Nuclei template, and no EPSS data yet, so exploitation is not currently observed, though pickle-based RCE primitives are well understood and quick to weaponize once a patch diff is public. Upgrade vLLM to 0.32.0 or later, and until then restrict API access to trusted callers and disable shared-memory multimodal caching in scale-out deployments.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. Impact is complete loss of confidentiality, integrity, and availability on the worker process (C:H/I:H/A:H). Exploitation needs network access, a valid low-privilege account (PR:L), and conditions that are hard to reproduce (AC:H): a scale-out deployment with shared-memory multimodal caching enabled. Exposure is therefore narrower than a default vLLM install, but multi-tenant and internally shared inference gateways, where many users hold valid API credentials, are at greatest risk. No active exploitation, public PoC, KEV entry, or scanner template is known, and the fix commit and advisory are public, which lowers the barrier for exploit development. EPSS data is not available.

How does the attack unfold?

Initial Access

Attacker authenticates to a scale-out vLLM multimodal endpoint using a valid low-privilege API credential.

AML.T0040

Exploitation

Attacker sends forged shared-memory address and monotonic_id values in features.kwargs_data, causing the worker to call pickle.loads() on attacker-selected bytes.

AML.T0049

Execution

Deserialization runs arbitrary Python code in the inference worker process.

AML.T0050

Impact

Attacker steals model weights, tenant prompts, and credentials, and pivots across the GPU cluster.

AML.T0025

Initial Access

Attacker authenticates to a scale-out vLLM multimodal endpoint using a valid low-privilege API credential.

AML.T0040

Exploitation

Attacker sends forged shared-memory address and monotonic_id values in features.kwargs_data, causing the worker to call pickle.loads() on attacker-selected bytes.

AML.T0049

Execution

Deserialization runs arbitrary Python code in the inference worker process.

AML.T0050

Impact

Attacker steals model weights, tenant prompts, and credentials, and pivots across the GPU cluster.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.32.0	`0.32.0`
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade vLLM to 0.32.0 or later (fix in PR 59357 and the linked commit; see GHSA-6757-hggm-hp2w). 2) If patching is delayed, disable shared-memory multimodal caching in scale-out deployments or run single-process serving. 3) Restrict the inference API to trusted callers behind authentication, network segmentation, and an API gateway; rotate and scope API keys. 4) Run workers with least privilege, in containers with no unneeded cloud credentials, read-only filesystems, and egress filtering. 5) Detect: alert on requests whose multimodal features.kwargs_data contains unexpected shared-memory address or monotonic_id fields, and on worker processes spawning shells, making unexpected outbound connections, or reading credential files. 6) Inventory vLLM versions via SBOM and container scanning.

How is it classified?

Code ExecutionSupply ChainInferenceFrameworkAML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-115912?

CVE-2026-115912 is an insecure deserialization flaw in vLLM's shared-memory multimodal cache: an authenticated caller can forge shared-memory address and monotonic_id values so that workers pass attacker-chosen bytes to pickle.loads(), yielding arbitrary Python execution even when insecure serialization is disabled. The CVSS score of 7.5 is held down by high attack complexity and the need for low-privilege credentials, but the impact is full compromise of inference workers that typically hold GPUs, model weights, and cloud credentials. There is no KEV listing, no public exploit, no Nuclei template, and no EPSS data yet, so exploitation is not currently observed, though pickle-based RCE primitives are well understood and quick to weaponize once a patch diff is public. Upgrade vLLM to 0.32.0 or later, and until then restrict API access to trusted callers and disable shared-memory multimodal caching in scale-out deployments.

Is CVE-2026-115912 actively exploited?

No confirmed active exploitation of CVE-2026-115912 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115912?

1) Upgrade vLLM to 0.32.0 or later (fix in PR 59357 and the linked commit; see GHSA-6757-hggm-hp2w). 2) If patching is delayed, disable shared-memory multimodal caching in scale-out deployments or run single-process serving. 3) Restrict the inference API to trusted callers behind authentication, network segmentation, and an API gateway; rotate and scope API keys. 4) Run workers with least privilege, in containers with no unneeded cloud credentials, read-only filesystems, and egress filtering. 5) Detect: alert on requests whose multimodal features.kwargs_data contains unexpected shared-memory address or monotonic_id fields, and on worker processes spawning shells, making unexpected outbound connections, or reading credential files. 6) Inventory vLLM versions via SBOM and container scanning.

What systems are affected by CVE-2026-115912?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, multimodal inference pipelines, distributed scale-out inference, multi-tenant inference gateways.

What is the CVSS score for CVE-2026-115912?

CVE-2026-115912 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inferencemultimodal inference pipelinesdistributed scale-out inferencemulti-tenant inference gateways

MITRE ATLAS Techniques

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.

Exploitation Scenario

An attacker with a low-privilege API key for a shared internal vLLM multimodal endpoint submits a crafted request whose features.kwargs_data carries forged shared-memory address and monotonic_id values. Because the scale-out workers trust these values when reading the shared-memory cache, they pass attacker-controlled bytes, planted in a reachable shared-memory region, to pickle.loads(). The payload runs arbitrary Python in the worker, from which the attacker reads model weights and other tenants' prompts, steals cloud credentials from the environment, and moves laterally to other nodes in the GPU cluster.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.