EUVD-2026-110022
GHSA-6757-hggm-hp2w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to public scale-out API
-
DeliveryStage malicious bytes via chat/completions into SHM
-
ExploitForge SHM address/monotonic_id carrier
-
ExecutionWorker unpickles attacker-controlled bytes
-
ImpactExecute arbitrary Python in worker process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the non-default shared-memory multimodal cache mode (--mm-processor-cache-type shm) enabled on a vLLM scale-out deployment, plus an authenticated caller (PR:L) with access to the public HTTP routes /v1/chat/completions/render, /v1/chat/completions, and /inference/v1/generate. The exploit abuses the built-in SHM object deserializer, so it works even with VLLM_ALLOW_INSECURE_SERIALIZATION=0 (it does NOT depend on the insecure-serialization flag or the optional msgpack ext-hook). Limiting factors: the vulnerable SHM caching feature must be explicitly enabled (not on by default), a scale-out topology must be in use, and the attacker must already hold valid authentication to the inference API; deployments without SHM multimodal caching are not exposed. |
| Impact | This is a genuine high-priority issue for the subset of deployments that match its preconditions, not a paper high-CVSS flaw. The impact is unauthenticated-of-config arbitrary Python execution (C:H/I:H/A:H) reachable over the network (AV:N) by any authenticated inference caller (PR:L, UI:N), which the vendor advisory confirms escalates to full worker RCE and was shown to also crash the EngineCore health endpoint (200→503). Signals conflict on complexity: the input top-level vector lists AC:H (base 7.5) while the vendor GHSA-6757-hggm-hp2w lists AC:L (base 8.8) - the advisory's deterministic three-call live chain supports AC:L, so the 7.5 likely understates reliability; verify with NVD/vendor. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The CVE is NOT in CISA KEV, so this is 'no public exploit identified at time of analysis' in KEV terms; however the advisory documents a confirmed working proof-of-concept chain executed by the reporting team (Trail of Bits + OpenAI, 'Patch the Planet'), so exploitability is proven even though no standalone weaponized exploit code is published. The vuln.today decision label is this_week, consistent with a serious, config-gated RCE rather than an emergency: the mitigating factor is that it only applies when non-default shared-memory multimodal caching is enabled in a scale-out deployment. |
| Exploit ScenarioDerived | On a vLLM scale-out deployment running with --mm-processor-cache-type shm, an ordinary authenticated inference user calls /v1/chat/completions/render to obtain a valid feature envelope, uses /v1/chat/completions to stage attacker-chosen bytes into the shared-memory ring buffer, then submits a forged inner SHM carrier (attacker-chosen address and monotonic_id in public features.kwargs_data) via /inference/v1/generate. The worker trusts the pair, dereferences the staged bytes, and reaches pickle.loads(), executing arbitrary Python in the worker process even with VLLM_ALLOW_INSECURE_SERIALIZATION=0. The reporting researchers demonstrated this live chain with a benign marker gadget; no standalone public exploit code is published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Authenticated inference callers on vLLM scale-out deployments that explicitly enable the shared-memory multimodal processor cache (--mm-processor-cache-type shm) can plant forged address and monotonic_id values inside the public features.kwargs_data envelope, causing a worker to dereference attacker-chosen ring-buffer memory and pass those bytes to pickle.loads(), which yields arbitrary Python execution in the worker process. The chain runs over ordinary public HTTP routes (/v1/chat/completions/render, /v1/chat/completions, /inference/v1/generate) and succeeds even with VLLM_ALLOW_INSECURE_SERIALIZATION=0 because it abuses the built-in SHM object deserializer rather than the optional insecure-serialization flag. Exposure is limited to deployments combining a scale-out topology with the non-default SHM cache mode; the flaw is fixed in vLLM 0.32.0, CISA KEV does not list it, and a proof-of-concept chain is described in the upstream advisory but no public working exploit code was confirmed at time of analysis.
RemediationAI
Vendor-released patch: vLLM 0.32.0 - upgrade to 0.32.0 or later, which introduces server-issued HMAC signatures over (cache_key, address, monotonic_id), validates them at the public scale-out boundary and again in the reader before dereferencing shared memory, and rotates the signing secret when the cache is cleared (see https://github.com/vllm-project/vllm/releases/tag/v0.32.0, PR https://github.com/vllm-project/vllm/pull/59357, commit https://github.com/vllm-project/vllm/commit/3d5625cc3c2474994107047d7a6ecb8e4008f9b0, advisory https://github.com/vllm-project/vllm/security/advisories/GHSA-6757-hggm-hp2w). If upgrading cannot be done immediately, remove exposure by not running the multimodal processor cache in shm mode - switch --mm-processor-cache-type away from shm so no SHM handles are dereferenced (trade-off: loses the shared-memory cache's cross-process reuse and may raise multimodal prefill cost and memory pressure), and/or keep the scale-out routes (/v1/chat/completions/render, /v1/chat/completions, /inference/v1/generate) reachable only by fully trusted, authenticated callers since the flaw requires a valid API principal (trade-off: restricts multi-tenant or externally shared inference access). Note that setting VLLM_ALLOW_INSECURE_SERIALIZATION=0 does not mitigate this issue, as the vulnerable path uses the built-in SHM deserializer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) in vLLM's multimodal shared-memory cache. When --mm-processor-cache-type shm is enabled, the SHM ring buffer represents each cached item as an (address, monotonic_id) pair, and the worker treats possession of that pair as sufficient authority to read shared memory. vllm/entrypoints/scale_out/token_in_token_out/serving.py decodes caller-supplied features.kwargs_data into MultiModalKwargsItem objects without authenticating SHM handles; vllm/multimodal/cache.py (get_and_update_item) then reads the untrusted address/monotonic_id and calls the SHM cache's get(); the dereference lands in vllm/distributed/device_communicators/shm_object_storage.py deserialize(), which calls pickle.loads() on any chunk tagged as 'bytes'. Because the attacker can first stage arbitrary bytes into the ring buffer via a normal multimodal request, the forged handle turns a benign cache lookup into unpickling of attacker-controlled data. The root cause is missing binding between a handle and its cache key/issuer. The upstream fix adds an HMAC signature over (cache_key, address, monotonic_id), keyed by a 32-byte secret stored in the ring buffer and rotated on clear(), validated both at the public scale-out boundary before engine handoff and again on the reader side before the dereference; it also makes monotonic IDs continue increasing across clear() so pre-clear handles cannot alias newly written data. The trigger path is specifically the scale-out token-in/token-out entrypoint plus the trust-the-pair worker lookup described in the advisory.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable public API (AV:N), authenticated caller required (PR:L), no user interaction, and deterministic forge-and-unpickle chain (AC:L) yielding full worker RCE (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.
Blast Radius
ecosystem impact- 94 pypi packages depend on vllm (94 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.32.0.
Technical POC Analysis
CWE-502 (Deserialization of Untrusted Data).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity flaw in vLLM, an open-source large language model inference server, could allow an authenticated user to execute arbitrary code inside worker processes on scale-out deployments that have enabled the non-default shared-memory multimodal processor cache. Only organizations running this specific configuration are exposed, but for those affected, a successful attack could compromise the model-serving infrastructure and any data or credentials it can reach. Leadership should care because this places AI inference workloads at risk of takeover despite existing insecure-serialization protections being left in their secure setting.
No vendor-released patch identified at time of analysis; interim mitigation is to disable the non-default --mm-processor-cache-type shm mode and restrict the public inference routes to trusted authenticated callers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB