vLLM
CVE-2026-54232
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker needs no privileges or auth - only a PyPI registration - but a victim must actually build the Dockerfile, hence UI:R; build-time root RCE yields full C/I/A.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.
Articles & Coverage 1
AnalysisAI
Remote code execution in vLLM versions prior to 0.22.1 allows attackers to backdoor production LLM inference deployments through a dependency confusion attack in the project's Dockerfile. Because flashinfer-jit-cache was pulled via --extra-index-url with UV_INDEX_STRATEGY=unsafe-best-match while the name remained unregistered on PyPI, any attacker who claimed the name on PyPI with a higher version would have their code executed as root during every Docker build. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a victim building the vLLM Docker image from a vulnerable Dockerfile prior to 0.22.1 that sets UV_INDEX_STRATEGY=unsafe-best-match and installs flashinfer-jit-cache via --extra-index-url https://flashinfer.ai/whl/, and (2) the attacker having previously registered flashinfer-jit-cache on PyPI with a version string sorting higher than the legitimate vendor-index release (the description cites 0.6.11.post2). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately captures that an unauthenticated network-borne supply-chain action (registering a PyPI name) yields full confidentiality, integrity, and availability loss once a victim builds the image. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers the name flashinfer-jit-cache on PyPI with version 0.6.11.post2 (higher than the legitimate vendor-index wheel) containing a malicious setup.py or wheel post-install hook. When a victim builds the official vLLM Docker image, uv resolves the higher PyPI version and executes the attacker's code as root during the build, installing a persistent backdoor that exfiltrates prompts, API credentials, and model artifacts from every container subsequently deployed from that image. |
| Remediation | Upgrade to vLLM 0.22.1, which removes the unsafe index strategy and/or pins flashinfer-jit-cache to a trusted source; this is the only complete fix and is documented in GHSA-jrf6-vqxq-pjv2 (https://github.com/vllm-project/vllm/security/advisories/GHSA-jrf6-vqxq-pjv2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all vLLM instances, identify current versions in use, and disable automated Docker builds for versions prior to 0.22.1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote code execution in Crawl4AI versions <= 0.8.6 allows attackers to escape the AST-based sandbox in
Arbitrary file read in Budibase self-hosted server (@budibase/server <= 3.39.0) allows an authenticated workspace builde
Path traversal in BBOT's unarchive internal module enables a malicious archive hosted by attacker-controlled infrastruct
Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
Server-side request forgery in Crawl4AI's Docker API server (versions <= 0.8.8) allows unauthenticated remote attackers
Share
External POC / Exploit Code
Leaving vuln.today