AI Threat AlertCVE-2026-126398: vLLM: reachable assertion in XD-RoPE crashes engine
MEDIUMCVE-2026-126398 is a reachable assertion in vLLM's GPUModelRunner._init_xdrope_positions (CWE-617). An unauthenticated remote attacker can send a /v1/completions request containing only prompt_embeds to an XD-RoPE model and kill the EngineCore and API server for every client. Severity is medium (CVSS 5.9, high attack complexity) because the flaw only affects availability, and it needs the non-default --enable-prompt-embeds flag. There is no public exploit, no Nuclei template and no KEV listing, and EPSS data is not yet available. Even so, the crash takes down shared inference, so internet-exposed or multi-tenant deployments should treat it as a real outage risk. Upgrade to vLLM 0.30.0 or later, and until then disable --enable-prompt-embeds or put authentication in front of the endpoint.
What is the risk?
Overall risk is medium. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with A:H and no confidentiality or integrity impact. A single malformed request can crash the whole engine, so exploit effort is low once the preconditions are met. Those preconditions are: version 0.28.0 up to (not including) 0.30.0, an XD-RoPE model, and --enable-prompt-embeds turned on. No exploitation in the wild, no public PoC, no scanner template and no KEV listing were reported at publication. EPSS and SSVC data are unavailable. Risk rises for internet-exposed, unauthenticated or multi-tenant endpoints, and for business-critical inference services without automatic restart.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | — | No patch |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade vLLM to 0.30.0 or later (see GHSA-5q78-j82c-2vr2).
If you cannot patch right away, remove --enable-prompt-embeds from the launch arguments.
Do not expose the vLLM OpenAI-compatible API directly to untrusted networks. Put an authenticating gateway or reverse proxy in front of it and restrict access by network policy.
Have the gateway reject /v1/completions requests that carry prompt_embeds without a prompt, if the feature is not needed.
Add health checks and automatic restart with backoff, and alert on repeated EngineCore terminations or assertion errors in logs.
Inventory vLLM instances, versions and flags to find which ones run XD-RoPE models with prompt embeds enabled.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-126398?
CVE-2026-126398 is a reachable assertion in vLLM's GPUModelRunner._init_xdrope_positions (CWE-617). An unauthenticated remote attacker can send a /v1/completions request containing only prompt_embeds to an XD-RoPE model and kill the EngineCore and API server for every client. Severity is medium (CVSS 5.9, high attack complexity) because the flaw only affects availability, and it needs the non-default --enable-prompt-embeds flag. There is no public exploit, no Nuclei template and no KEV listing, and EPSS data is not yet available. Even so, the crash takes down shared inference, so internet-exposed or multi-tenant deployments should treat it as a real outage risk. Upgrade to vLLM 0.30.0 or later, and until then disable --enable-prompt-embeds or put authentication in front of the endpoint.
Is CVE-2026-126398 actively exploited?
No confirmed active exploitation of CVE-2026-126398 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-126398?
1. Upgrade vLLM to 0.30.0 or later (see GHSA-5q78-j82c-2vr2). 2. If you cannot patch right away, remove --enable-prompt-embeds from the launch arguments. 3. Do not expose the vLLM OpenAI-compatible API directly to untrusted networks. Put an authenticating gateway or reverse proxy in front of it and restrict access by network policy. 4. Have the gateway reject /v1/completions requests that carry prompt_embeds without a prompt, if the feature is not needed. 5. Add health checks and automatic restart with backoff, and alert on repeated EngineCore terminations or assertion errors in logs. 6. Inventory vLLM instances, versions and flags to find which ones run XD-RoPE models with prompt embeds enabled.
What systems are affected by CVE-2026-126398?
This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, multi-tenant inference APIs, RAG pipelines, agent frameworks.
What is the CVSS score for CVE-2026-126398?
CVE-2026-126398 has a CVSS v3.1 base score of 5.9 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0040AI Model Inference API AccessAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only prompt_embeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients.
Exploitation Scenario
An attacker finds an exposed vLLM server that serves an XD-RoPE model and has prompt embeddings enabled. They send a single POST to /v1/completions with only a prompt_embeds field and no text prompt. This triggers the assertion in GPUModelRunner._init_xdrope_positions, the EngineCore terminates, and the API server stops responding to all users. The attacker then repeats the request each time the service restarts, which keeps a production AI service offline at almost no cost.
Weaknesses (CWE)
CWE-617 — Reachable Assertion: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
- [Implementation] If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
- [Implementation] Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm