CVE-2026-129356 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
vLLM 0.30.0 and 0.31.0 contain a race condition in the common prefix handling code of single_type_kv_cache_manager.py. A remote attacker may be able to trigger it, with a public exploit reported, but the sources say exploitation is highly complex and difficult.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running vLLM 0.30.0 or 0.31.0 as a model serving backend, especially where the server accepts requests from outside the network. The sources do not state whether a particular configuration is required to reach the flawed code. Deployments on other vLLM versions are not named as affected.
Not affected if other-vllm-versions
Who cares ai-inference, python, self-hosted, vllm
pip show vllm and look for 0.30.0 or 0.31.0.0.32.0, per the sources.A vulnerability was found in vllm-project vllm 0.30.0/0.31.0. This vulnerability affects unknown code of the file single_type_kv_cache_manager.py of the component Common Prefix Handler. The manipulation results in race condition. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 0.32.0 is able to resolve this issue. The patch is identified as e687a251bb056fa527846633f7a1b0a6c0f42374. You should upgrade the affected component.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.