Live › vulnerability › CVE-2026-115912
Go to dashboardvLLM, an LLM inference and serving engine, trusts attacker-supplied shared-memory address and ID values in multimodal requests in scale-out deployments with shared-memory caching enabled. An authenticated caller can make workers unpickle attacker-chosen bytes, which runs arbitrary Python even when insecure serialization is disabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Deployments running vLLM before 0.32.0 that accept multimodal requests from callers with credentials and use scale-out workers with shared-memory multimodal caching enabled. Single-process setups and deployments without multimodal caching are less exposed, though the sources do not state this explicitly. Teams on 0.32.0 or later can skip it.
No product ranges from the sources yet.
pip show vllm and treat anything below 0.32.0 as exposed.0.32.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115912")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.