CVE-2026-114054 in vLLM
Summary
by MITRE • 10/21/2026
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in vLLM versions prior to 0.31.0 represents a critical security flaw rooted in improper handling of caching mechanisms within the large language model inference engine. This issue is classified as a cache aliasing or key collision vulnerability, which fundamentally undermines the isolation guarantees expected between different user requests and sessions. In distributed computing environments and high-throughput inference systems like vLLM, efficient memory management relies heavily on caching pre-computed states to reduce latency and computational overhead. However, when these caches are keyed using inputs that can be influenced by external actors without sufficient validation or randomization, the integrity of data isolation is compromised. This specific flaw allows authenticated attackers to manipulate cache keys through caller-controlled parameters such as EXIF ImageID fields within image metadata or custom cache_salt values used in Low-Rank Adaptation LoRA configurations.
From a technical perspective, the vulnerability exploits how vLLM maps input attributes to internal caching structures. When an attacker supplies a specific UUID value via the EXIF ImageID field of an uploaded image, they can force the system to generate a cache key that matches one already in use by another legitimate user's request. Similarly, by carefully selecting values for the cache_salt parameter associated with LoRA models, attackers can align their requests with existing first-block Key-Value KV state caches held in memory. This alignment results in the attacker receiving cached processed media or computational states intended for other users. The core technical failure lies in the lack of unique identifier generation and insufficient separation between user-specific context and shared cache resources, allowing malicious actors to hijack these shared assets through predictable key construction.
The operational impact of this vulnerability is severe, primarily affecting confidentiality and potentially integrity depending on the nature of the cached data. By colliding cache keys, an attacker can access sensitive information processed for other users, such as private images or proprietary model outputs. This constitutes a direct breach of multi-tenancy isolation, which is essential in cloud-based AI inference services where multiple customers share underlying infrastructure. Furthermore, reusing first-block KV states from LoRA configurations could allow attackers to bypass certain security checks embedded within the initial processing stages of a request, potentially leading to further exploitation vectors such as prompt injection or model manipulation if the reused state alters expected behavior patterns. The ability to read another user's cached media poses significant privacy risks and potential compliance violations under regulations like GDPR or HIPAA depending on the data types involved.
This vulnerability aligns with CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor, as well as CWE-697 regarding Incorrect Comparison. In terms of offensive security frameworks, it relates to ATT&CK technique T1530 Data from Cloud Storage Object or potentially T1048 if the cached data is used for further enumeration and discovery within the inference pipeline. The exploitation requires authentication, which limits the attack surface to compromised credentials or insider threats but significantly increases the severity due to the high trust level associated with authenticated sessions in enterprise AI deployments.
Mitigation strategies must focus on strengthening cache key generation and enforcing strict isolation boundaries. Upgrading vLLM to version 0.31.0 or later is the primary remediation step, as this release addresses the underlying logic errors that permit such collisions. For organizations unable to upgrade immediately, implementing additional validation layers at the API gateway level can help sanitize inputs before they reach the inference engine. Specifically, ensuring that EXIF fields and custom salt parameters are hashed using cryptographically secure random salts rather than being used directly in cache key derivation is essential. Additionally, enabling strict tenant isolation policies within vLLM configuration settings ensures that cached states are scoped strictly to individual user sessions or API keys, preventing cross-tenant visibility even if a collision occurs. Regular security audits of caching implementations and adherence to OWASP guidelines for secure data handling practices will further reduce the risk of similar vulnerabilities in future deployments.