What is the CVSS score of CVE-2026-54232?

CVE-2026-54232 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of vLLM are affected by CVE-2026-54232?

vLLM deployments running versions prior to 0.22.1 are vulnerable to remote code execution during Docker builds through a dependency confusion attack, allowing root-level code injection into…. A patch is available.

How to fix or mitigate CVE-2026-54232?

Within 24 hours: Audit all vLLM instances, identify current versions in use, and disable automated Docker builds for versions prior to 0.22.1. Within 7 days: Upgrade all affected deployments to vLLM 0.22.1 or later and rebuild all container images with the patched version. Within 30 days: Implement supply chain security controls including PyPI package mirroring/proxying, dependency hash pinning in build pipelines, and network restrictions limiting build environments to approved registries only.

vLLM CVE-2026-54232

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-06-22 GitHub_M

Docker RCE Vllm Red Hat

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Attacker needs no privileges or auth - only a PyPI registration - but a victim must actually build the Dockerfile, hence UI:R; build-time root RCE yields full C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

5.7 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 23:01 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on vllm (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.22.1.

DescriptionCVE.org

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.

Articles & Coverage 1

News 5 New Docker Vulnerabilities - 1 Critical, 4 High Severity Jun 23, 2026

AnalysisAI

Remote code execution in vLLM versions prior to 0.22.1 allows attackers to backdoor production LLM inference deployments through a dependency confusion attack in the project's Dockerfile. Because flashinfer-jit-cache was pulled via --extra-index-url with UV_INDEX_STRATEGY=unsafe-best-match while the name remained unregistered on PyPI, any attacker who claimed the name on PyPI with a higher version would have their code executed as root during every Docker build. No public exploit identified at time of analysis, but the supply-chain primitive is well understood and trivially weaponizable.

Technical ContextAI

vLLM is a widely used Python-based inference and serving engine for large language models, distributed in part via an official Dockerfile that uses uv/pip to install GPU helper wheels. The Dockerfile references flashinfer-jit-cache from the vendor index https://flashinfer.ai/whl/ as an --extra-index-url while also leaving PyPI as a candidate source. With UV_INDEX_STRATEGY set to unsafe-best-match globally, uv compares versions across all configured indexes and selects the highest, regardless of origin. This is a textbook CWE-427 Uncontrolled Search Path Element manifestation in the modern Python packaging ecosystem: because the attacker controls neither code nor infrastructure but does control which package is named highest on PyPI, a higher-versioned malicious flashinfer-jit-cache (e.g., 0.6.11.post2) wins resolution against the legitimate lower-versioned wheel on the private index. The affected CPE is cpe:2.3:a:vllm-project:vllm covering all releases prior to 0.22.1.

RemediationAI

Upgrade to vLLM 0.22.1, which removes the unsafe index strategy and/or pins flashinfer-jit-cache to a trusted source; this is the only complete fix and is documented in GHSA-jrf6-vqxq-pjv2 (https://github.com/vllm-project/vllm/security/advisories/GHSA-jrf6-vqxq-pjv2). Organizations that cannot immediately upgrade should rebuild Docker images only after removing UV_INDEX_STRATEGY=unsafe-best-match (forcing first-index resolution, at the cost of breaking installs if the private index is missing a needed wheel), explicitly pinning flashinfer-jit-cache with a hash via --require-hashes, or vendoring the wheel into the build context so PyPI is never consulted for that name. Any image built from a pre-0.22.1 Dockerfile during the exposure window should be treated as potentially backdoored, rotated, and rebuilt from a clean base, and any API keys, model weights, or prompt logs handled by such deployments should be considered compromised and rotated.