vLLM CVE-2026-105755

Requires a vLLM deployment (prior to 0.30.0) that exposes the flash late-interaction scoring path via the /score or /rerank endpoints, and a shared/multi-tenant context where multiple callers' requests are processed concurrently. The attacker must be able to send API requests (PR:L) and must set the X-Request-Id header to collide with a victim's in-flight request, then win a concurrency race (AC:H) against the victim's query-embedding cache write. Exploitation is LIMITED by: the narrow timing window of the race, the need to know or predict a victim's X-Request-Id, the requirement that the late-interaction scoring feature actually be in use, and the lack of value in single-tenant deployments. No special user interaction is needed.

This is a low-to-moderate priority issue despite the 'Authentication Bypass' tag. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) scores 4.2 (Medium) and is internally consistent with the description: network-reachable but requiring high attack complexity (the attacker must win a race against a concurrent victim request reusing the same X-Request-Id), low privileges (ability to send /score or /rerank API requests), and no confidentiality impact - only integrity (victim documents scored against the attacker's query) and availability (shared use-counter late-interaction cache-miss errors). CWE-639 (Authorization Bypass Through User-Controlled Key) accurately captures the root cause: a caller-controlled header used as a cache namespace key. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis'. The practical risk is confined to multi-tenant or shared vLLM scoring/rerank deployments; single-tenant deployments have little exposure because an attacker colliding with their own request IDs gains nothing. Note the tag 'Authentication Bypass' overstates the issue - this is an authorization/IDOR-style cache-key collision, not a bypass of authentication, and the attacker still needs valid API access (PR:L).

On a shared or multi-tenant vLLM server exposing the /score or /rerank late-interaction endpoints, an authenticated attacker observes or guesses a victim's X-Request-Id and fires a concurrent request reusing that identifier. Winning the race overwrites the cached query embedding, so the victim's documents are silently scored against the attacker's query (integrity corruption) or the shared use counter triggers a cache-miss error (availability). No public exploit code was identified; the attack requires precise concurrency timing (AC:H).