{"id":"CVE-2026-115912","kind":"vulnerability","aliases":["CVE-2026-115912"],"related":[],"title":"vLLM: forged shared-memory fields let an authenticated caller run Python code","description":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.","summary":"vLLM, an LLM inference and serving engine, trusts attacker-supplied shared-memory address and ID values in multimodal requests in scale-out deployments with shared-memory caching enabled. An authenticated caller can make workers unpickle attacker-chosen bytes, which runs arbitrary Python even when insecure serialization is disabled.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-inference","multimodal","python","self-hosted","vllm"],"not_affected_if":["no-multimodal-caching","single-process","version-0.32.0-or-later"],"how_to_check":"- Check the installed version with `pip show vllm` and treat anything below `0.32.0` as exposed.\n- Check whether the deployment runs scale-out workers with shared-memory multimodal caching enabled; the sources do not name the exact flag, so look for it in the serving configuration.","fix":"- Upgrade vLLM to `0.32.0` or later.\n- Until upgraded, restrict who can send requests to the serving endpoint and disable shared-memory multimodal caching if the configuration allows it.","status":"open","published_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:07+00:00","updated_at":"2026-10-26T17:33:07+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T17:33:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.32.0` or later.\n- Until upgraded, restrict who can send requests to the serving endpoint and disable shared-memory multimodal caching if the configuration allows it.","reach":"network","title":"vLLM: forged shared-memory fields let an authenticated caller run Python code","impact":"high","summary":"vLLM, an LLM inference and serving engine, trusts attacker-supplied shared-memory address and ID values in multimodal requests in scale-out deployments with shared-memory caching enabled. An authenticated caller can make workers unpickle attacker-chosen bytes, which runs arbitrary Python even when insecure serialization is disabled.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","llm-inference","multimodal"],"confidence":0.7,"needs_auth":"yes","worst_case":"Arbitrary Python code runs on inference worker hosts.","analyst_note":"Confirm the exact configuration flag that enables shared-memory multimodal caching in scale-out mode and whether single-process deployments are affected, using the NVD entry and the vLLM 0.32.0 release notes or advisory.","how_to_check":"- Check the installed version with `pip show vllm` and treat anything below `0.32.0` as exposed.\n- Check whether the deployment runs scale-out workers with shared-memory multimodal caching enabled; the sources do not name the exact flag, so look for it in the serving configuration.","needs_analyst":true,"not_affected_if":["version-0.32.0-or-later","no-multimodal-caching","single-process"],"who_is_affected":"Deployments running vLLM before 0.32.0 that accept multimodal requests from callers with credentials and use scale-out workers with shared-memory multimodal caching enabled. Single-process setups and deployments without multimodal caching are less exposed, though the sources do not state this explicitly. Teams on 0.32.0 or later can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":3357,"output_tokens":716,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115912':16A,19A '-2026':15A,18A '0.32.0':98C,158C 'address':46B,108C 'ai':21B 'ai-tool':20B 'allow':142C 'arbitrari':77B,143C 'attack':41B,72B,137C 'attacker-chosen':71B 'attacker-select':136C 'attacker-suppli':40B 'authent':9A,65B,100C 'byte':74B,139C 'cach':62B,128C 'caller':10A,66B,101C 'chosen':73B 'code':13A 'cve':14A,17A 'data':117C 'deploy':57B,122C 'disabl':84B,151C 'enabl':63B,129C 'engin':38B,91C 'even':79B,146C 'execut':145C 'features.kwargs':116C 'field':6A 'fix':155C 'forg':2A,104C 'host':30B 'id':48B,111C 'infer':25B,35B,88C 'insecur':81B,148C 'issu':153C 'languag':94C 'larg':93C 'let':7A 'llm':24B,34B 'llm-infer':23B 'make':68B 'memori':5A,45B,61B,107C,126C 'model':95C 'monoton':110C 'multimod':26B,51B,115C,127C 'pass':135C 'pickle.loads':141C 'place':103C 'prior':96C 'public':114C 'python':12A,27B,78B,144C 'request':52B 'run':11A,76B 'scale':55B,120C 'scale-out':54B,119C 'select':138C 'self':29B 'self-host':28B 'serial':82B,149C 'serv':37B,90C 'share':4A,44B,60B,106C,125C 'shared-memori':3A,43B,59B,105C,124C 'suppli':42B 'tool':22B 'trust':39B,131C 'unpickl':70B 'valu':49B,112C,133C 'version':157C 'vllm':1A,31B,32B,85C 'worker':69B,130C","nicknames":[],"mitigations":[],"who_affected":"Deployments running vLLM before 0.32.0 that accept multimodal requests from callers with credentials and use scale-out workers with shared-memory multimodal caching enabled. Single-process setups and deployments without multimodal caching are less exposed, though the sources do not state this explicitly. Teams on 0.32.0 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115912","severity":null,"published_at":"2026-10-26T17:17:18+00:00","modified_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}