vLLM CVE-2026-73555

Exploitation requires that the target is running vLLM prior to version 0.26.0 with the OpenAI-compatible API server active, which is the default serving mode (vllm serve). No authentication is required - the CVSS PR:N vector confirms unauthenticated exploitation. The attacker must be able to reach at least one of the four affected endpoints (/v1/chat/completions, /v1/completions, /tokenize, /detokenize) over the network and must submit a request body that fails FastAPI's Pydantic validation (e.g., wrong field type). No non-default configuration is necessary; any default vLLM OpenAI API server deployment is affected. Exploitation is bounded to information disclosure only - there is no code execution, authentication bypass, or data modification capability. Deployments placed behind a reverse proxy that enforces authentication (such as an API gateway requiring bearer tokens) are protected from external unauthenticated exploitation, though the flaw persists at the application layer for any authenticated caller.

The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately captures the network-accessible, zero-auth, information-disclosure-only nature of this flaw with no integrity or availability impact. However, the low complexity and zero-privilege requirements mean that exploitation is trivial against any internet-exposed vLLM instance - a single malformed JSON request suffices. No EPSS score was provided in the input data; exploitation probability cannot be quantified from available signals beyond the CVSS vector. There is no CISA KEV listing, and no standalone POC exploit has been identified - the public PR diff itself illustrates the vulnerability but is not packaged as an exploit tool. The disclosed data (filesystem layout, Python version, package paths, handler names) has meaningful reconnaissance value: it enables targeted path traversal attempts, dependency confusion attacks, or version-specific exploit chaining. For publicly exposed vLLM inference servers - a common deployment pattern for shared inference infrastructure - this represents a realistic, low-effort first-stage reconnaissance capability with no false negatives.

An unauthenticated attacker sends a single HTTP POST request to /v1/chat/completions on a publicly exposed vLLM server with a malformed body - for example, setting messages to a string instead of an array - causing FastAPI to raise a RequestValidationError. The unpatched validation_exception_handler serializes the exception with str(exc), which includes FastAPI-injected endpoint context attributes such as the full server filesystem path (e.g., /usr/local/lib/python3.12/dist-packages/vllm/entrypoints/serve/utils/api_utils.py), the handler function name (create_chat_completion), and line number. The attacker extracts these details from the HTTP 422 error response body to map the server's directory layout, Python version, and package installation structure for use in subsequent targeted attacks.