CVE-2026-126398 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
vLLM from 0.28.0 before 0.30.0 has a reachable assertion in GPUModelRunner._init_xdrope_positions. A remote attacker who sends a /v1/completions request containing only prompt_embeds can crash the EngineCore and API server, cutting off all clients.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only servers running vLLM 0.28.0 to before 0.30.0 with --enable-prompt-embeds enabled and an XD-RoPE model loaded are exposed. Any client that can reach the completions endpoint can trigger the crash, so the exposure is the reachable API itself. Deployments without prompt embeds enabled or without XD-RoPE models can skip it.
Not affected if default-config, non-xdrope-models
Who cares llm-serving, python, self-hosted, vllm
pip show vllm and whether it falls in 0.28.0 up to but not including 0.30.0.--enable-prompt-embeds and serves XD-RoPE models.0.30.0 or later (the sources state the fixed version as 0.30.0).vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only prompt_embeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.