{"id":"GHSA-v97p-wpxp-px84","kind":"vulnerability","aliases":["GHSA-v97p-wpxp-px84"],"related":[],"title":"Cross-user token data leakage in async scheduling + Pipeline Parallelism","description":"### Summary\nWhen the V1 model runner uses async scheduling with pipeline parallelism (`pipeline_parallel_size > 1`), token data from a previous user's request context can leak into another user's response.\n\nA detailed technical analysis has been reported in https://github.com/vllm-project/vllm/issues/38903#issue-4199660402.\n\n**Affected versions:** v0.16.0 through v0.20.2 when using the V1 model runner with async scheduling and pipeline parallelism.\n\n**Patched version:** v0.21.0.\n\n### Details\n**Root cause:** On non-last pipeline ranks during async scheduling, `token_ids_cpu` is never written with generated tokens, and `num_tokens_no_spec` is incorrectly reset each step. When the `token_ids_cpu` fallback path is triggered (e.g., mixed prefill/decode batches), stale token data from a previous request occupying the same batch slot is read as model input and written into the KV cache, permanently contaminating the response.\n\n### Impact\nThis constitutes a cross-user data leak in multi-tenant inference deployments. In environments where users submit sensitive or private prompts (e.g., personal information, proprietary business data, medical or legal content), fragments of one user's context can influence or appear in another user's output.\n\n### Workaround\nFor deployments on affected versions, either of these settings mitigates the issue.\n\n- Launching vLLM with `--no-async-scheduling`\n- Setting `pipeline_parallel_size=1` (disabling pipeline parallelism)\n\nA fix for this was introduced in https://github.com/vllm-project/vllm/pull/41133.","summary":"When vLLM's V1 model runner uses async scheduling with pipeline parallelism, stale token data from one user's earlier request can be fed into another user's batch slot. The contamination can then appear in the other user's model output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.21.0"],"affected":">= 0.16.0, < 0.21.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","llm-serving","multi-tenant","python","vllm"],"not_affected_if":["default-config","no-async-scheduling","pipeline-parallel-size-1","single-tenant"],"how_to_check":"- Check the installed vLLM version with `pip show vllm`; affected versions are `>= 0.16.0` and `< 0.21.0`.\n- Look for `--no-async-scheduling` and `pipeline_parallel_size` settings in the vLLM launch command or config; the issue needs async scheduling and `pipeline_parallel_size > 1`.","fix":"- vLLM: move to `0.21.0` or later.\n- Workaround from the advisory until upgraded: launch with `--no-async-scheduling`, or set `pipeline_parallel_size=1`.","status":"open","published_at":"2026-11-09T17:29:51+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","triaged_at":"2026-11-09T22:57:02+00:00","updated_at":"2026-11-09T22:57:02+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:57:02Z","model":"claude-haiku-5-5","output":{"fix":"- vLLM: move to `0.21.0` or later.\n- Workaround from the advisory until upgraded: launch with `--no-async-scheduling`, or set `pipeline_parallel_size=1`.","reach":"unknown","title":"vLLM: async scheduling with pipeline parallelism leaks tokens across users","impact":"medium","summary":"When vLLM's V1 model runner uses async scheduling with pipeline parallelism, stale token data from one user's earlier request can be fed into another user's batch slot. The contamination can then appear in the other user's model output.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","multi-tenant","llm-serving"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Fragments of one user's prompt context appear in another user's output.","analyst_note":"","how_to_check":"- Check the installed vLLM version with `pip show vllm`; affected versions are `>= 0.16.0` and `< 0.21.0`.\n- Look for `--no-async-scheduling` and `pipeline_parallel_size` settings in the vLLM launch command or config; the issue needs async scheduling and `pipeline_parallel_size > 1`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","pipeline-parallel-size-1","no-async-scheduling","single-tenant"],"who_is_affected":"Deployments of vLLM from `0.16.0` through `0.20.2` that use the V1 model runner with async scheduling and pipeline parallelism (`pipeline_parallel_size > 1`) are exposed, especially multi-tenant inference serving where users submit private prompts. Single-GPU or non-pipeline-parallel deployments, and deployments with async scheduling turned off, are not affected according to the advisory's root cause.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000848,"input_tokens":5056,"output_tokens":684,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'/vllm-project/vllm/issues/38903#issue-4199660402.':118C '/vllm-project/vllm/pull/41133.':296C '1':91C,283C 'affect':119C,263C 'ai':24B 'ai-tool':23B 'analysi':111C 'anoth':59B,104C,255C 'appear':68B,253C 'async':8A,41B,83C,131C,149C,277C 'batch':62B,182C,193C 'busi':238C 'cach':205C 'caus':141C 'constitut':212C 'contamin':65B,207C 'content':243C 'context':100C,249C 'cpu':153C,174C 'cross':2A,215C 'cross-us':1A,214C 'data':5A,48B,93C,185C,217C,239C 'deploy':224C,261C 'detail':109C,139C 'disabl':284C 'e.g':179C,234C 'earlier':53B 'either':265C 'environ':226C 'fallback':175C 'fed':57B 'fix':288C 'fragment':244C 'generat':158C 'ghsa':13A,18A 'ghsa-v97p-wpxp-px84':12A,17A 'github.com':117C,295C 'github.com/vllm-project/vllm/issues/38903#issue-4199660402.':116C 'github.com/vllm-project/vllm/pull/41133.':294C 'id':152C,173C 'impact':210C 'incorrect':166C 'infer':223C 'influenc':251C 'inform':236C 'input':199C 'introduc':292C 'issu':271C 'kv':204C 'last':145C 'launch':272C 'leak':102C,218C 'leakag':6A 'legal':242C 'llm':27B 'llm-serv':26B 'medic':240C 'mitig':269C 'mix':180C 'model':38B,74B,80C,128C,198C 'multi':30B,221C 'multi-ten':29B,220C 'never':155C 'no-async-schedul':275C 'non':144C 'non-last':143C 'num':161C 'occupi':190C 'one':50B,246C 'output':75B,258C 'parallel':11A,45B,87C,89C,135C,281C,286C 'patch':136C 'path':176C 'perman':206C 'person':235C 'pipelin':10A,44B,86C,88C,134C,146C,280C,285C 'prefill/decode':181C 'previous':96C,188C 'privat':232C 'prompt':233C 'proprietari':237C 'px84':16A,21A 'python':32B 'rank':147C 'read':196C 'report':114C 'request':54B,99C,189C 'reset':167C 'respons':107C,209C 'root':140C 'runner':39B,81C,129C 'schedul':9A,42B,84C,132C,150C,278C 'sensit':230C 'serv':28B 'set':268C,279C 'size':90C,282C 'slot':63B,194C 'spec':164C 'stale':46B,183C 'step':169C 'submit':229C 'summari':76C 'technic':110C 'tenant':31B,222C 'token':4A,47B,92C,151C,159C,162C,172C,184C 'tool':25B 'trigger':178C 'use':40B,82C,125C 'user':3A,51B,60B,72B,97C,105C,216C,228C,247C,256C 'v0.16.0':121C 'v0.20.2':123C 'v0.21.0':138C 'v1':37B,79C,127C 'v97p':14A,19A 'version':120C,137C,264C 'vllm':22A,33B,35B,273C 'workaround':259C 'wpxp':15A,20A 'written':156C,201C","nicknames":[],"mitigations":[],"who_affected":"Deployments of vLLM from `0.16.0` through `0.20.2` that use the V1 model runner with async scheduling and pipeline parallelism (`pipeline_parallel_size > 1`) are exposed, especially multi-tenant inference serving where users submit private prompts. Single-GPU or non-pipeline-parallel deployments, and deployments with async scheduling turned off, are not affected according to the advisory's root cause.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["vllm"],"ptokens":["vllm"],"labels":["aitooling","llmserving","medium","multitenant","pypi","python","vllm"],"campaign_type":null,"search_a":"'async':8A 'cross':2A 'cross-us':1A 'data':5A 'ghsa':13A,18A 'ghsa-v97p-wpxp-px84':12A,17A 'leakag':6A 'parallel':11A 'pipelin':10A 'px84':16A,21A 'schedul':9A 'token':4A 'user':3A 'v97p':14A,19A 'vllm':22A 'wpxp':15A,20A","search_b":"'ai':24B 'ai-tool':23B 'anoth':59B 'appear':68B 'async':41B 'batch':62B 'contamin':65B 'data':48B 'earlier':53B 'fed':57B 'llm':27B 'llm-serv':26B 'model':38B,74B 'multi':30B 'multi-ten':29B 'one':50B 'output':75B 'parallel':45B 'pipelin':44B 'python':32B 'request':54B 'runner':39B 'schedul':42B 'serv':28B 'slot':63B 'stale':46B 'tenant':31B 'token':47B 'tool':25B 'use':40B 'user':51B,60B,72B 'v1':37B 'vllm':33B,35B","search_c":"'/vllm-project/vllm/issues/38903#issue-4199660402.':118C '/vllm-project/vllm/pull/41133.':296C '1':91C,283C 'affect':119C,263C 'analysi':111C 'anoth':104C,255C 'appear':253C 'async':83C,131C,149C,277C 'batch':182C,193C 'busi':238C 'cach':205C 'caus':141C 'constitut':212C 'contamin':207C 'content':243C 'context':100C,249C 'cpu':153C,174C 'cross':215C 'cross-us':214C 'data':93C,185C,217C,239C 'deploy':224C,261C 'detail':109C,139C 'disabl':284C 'e.g':179C,234C 'either':265C 'environ':226C 'fallback':175C 'fix':288C 'fragment':244C 'generat':158C 'github.com':117C,295C 'github.com/vllm-project/vllm/issues/38903#issue-4199660402.':116C 'github.com/vllm-project/vllm/pull/41133.':294C 'id':152C,173C 'impact':210C 'incorrect':166C 'infer':223C 'influenc':251C 'inform':236C 'input':199C 'introduc':292C 'issu':271C 'kv':204C 'last':145C 'launch':272C 'leak':102C,218C 'legal':242C 'medic':240C 'mitig':269C 'mix':180C 'model':80C,128C,198C 'multi':221C 'multi-ten':220C 'never':155C 'no-async-schedul':275C 'non':144C 'non-last':143C 'num':161C 'occupi':190C 'one':246C 'output':258C 'parallel':87C,89C,135C,281C,286C 'patch':136C 'path':176C 'perman':206C 'person':235C 'pipelin':86C,88C,134C,146C,280C,285C 'prefill/decode':181C 'previous':96C,188C 'privat':232C 'prompt':233C 'proprietari':237C 'rank':147C 'read':196C 'report':114C 'request':99C,189C 'reset':167C 'respons':107C,209C 'root':140C 'runner':81C,129C 'schedul':84C,132C,150C,278C 'sensit':230C 'set':268C,279C 'size':90C,282C 'slot':194C 'spec':164C 'stale':183C 'step':169C 'submit':229C 'summari':76C 'technic':110C 'tenant':222C 'token':92C,151C,159C,162C,172C,184C 'trigger':178C 'use':82C,125C 'user':97C,105C,216C,228C,247C,256C 'v0.16.0':121C 'v0.20.2':123C 'v0.21.0':138C 'v1':79C,127C 'version':120C,137C,264C 'vllm':273C 'workaround':259C 'written':156C,201C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:29:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-v97p-wpxp-px84","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-v97p-wpxp-px84","severity":"medium","published_at":"2026-11-09T17:29:51+00:00","modified_at":"2026-11-09T17:29:51+00:00","first_seen_at":"2026-11-09T22:53:23+00:00","fetched_at":"2026-11-09T22:53:23+00:00","note":null}],"documents":[{"id":110577,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-v97p-wpxp-px84","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}