CVE-2026-73555: vLLM: verbose errors leak host paths & usernames

vLLM's OpenAI-compatible API returns raw Python tracebacks on malformed JSON requests, exposing the OS username, home and virtualenv paths, Python version, internal package layout, and endpoint handler names to any unauthenticated caller. The blast radius is real given vLLM's dominance as a self-hosted LLM inference engine, but the exploitation math is modest: EPSS sits at 0.26%, there's no public exploit or Nuclei template, it's not in CISA KEV, and CISA's own SSVC decision is TRACK rather than Act. The value to an attacker is reconnaissance, not direct compromise — CVSS confirms this with C:L/I:N/A:N, no integrity or availability impact. Patch to vLLM 0.26.0, which fixes both the exception handler and the message sanitizer; until then, front the API with a reverse proxy that strips 5xx bodies before they reach clients and monitor for repeated malformed-JSON probes as a recon signal.

No confirmed active exploitation of CVE-2026-73555 has been reported, but organizations should still patch proactively.

Upgrade to vLLM 0.26.0 or later, which fixes both validation_exception_handler and sanitize_message to strip traceback-style paths. Until patched, place a reverse proxy or API gateway in front of vLLM that returns generic error bodies on 4xx/5xx rather than passing through vLLM's raw response. Restrict network exposure of inference endpoints to trusted internal networks or authenticated gateways rather than the open internet. Detection: monitor access logs for repeated malformed-JSON POSTs to inference endpoints (a common recon pattern), and audit whether error responses in your environment currently leak filesystem paths by sending a deliberately malformed request and inspecting the response.

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, RAG pipelines, agent frameworks.

CVE-2026-73555 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.42%.