CVE-2026-105755: vLLM Information Disclosure Vulnerability

CVE-2026-105755 Overview

CVE-2026-105755 affects vLLM, an inference and serving engine for large language models. The vulnerability resides in the flash late-interaction scoring logic exposed through the /score and /rerank endpoints. Prior to version 0.30.0, each worker derives its query_key value directly from the caller-controlled X-Request-Id HTTP header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding, causing the victim's documents to be scored against the attacker's query. The same shared-identifier reuse can also trigger a late-interaction cache-miss error, degrading service reliability. The maintainers resolved the issue in vLLM 0.30.0 by using server-generated keys.

Critical Impact
An attacker able to reach the vLLM scoring API can corrupt another user's ranking results and induce cache-miss errors by sending a concurrent request with the same X-Request-Id.

Affected Products

vLLM versions prior to 0.30.0
Deployments exposing the /score endpoint
Deployments exposing the /rerank endpoint

Discovery Timeline

2026-10-05 - CVE-2026-105755 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105755

Vulnerability Analysis

The vulnerability is an authorization and request-identity flaw classified under [CWE-639] (Authorization Bypass Through User-Controlled Key). vLLM's flash late-interaction scoring path caches a per-request query embedding keyed by an identifier derived from the inbound X-Request-Id header. Because the header is attacker-controlled, two concurrent requests supplying the same value share cache state across tenants.

The practical impact is twofold. First, an attacker-supplied query embedding can overwrite the cached entry for a victim request, so the victim's documents are scored against the attacker's query and returned ranking scores become untrustworthy. Second, concurrent reuse of the identifier mishandles shared use counters, producing a late-interaction cache-miss error that disrupts legitimate scoring and reranking workflows.

Root Cause

The cache key for the late-interaction query embedding was constructed from a client header rather than a server-generated value. Any client that sets X-Request-Id controls the key under which its query data is stored and retrieved, violating isolation between concurrent requests.

Attack Vector

Exploitation requires network access to the vLLM HTTP API and low privileges equivalent to a normal API caller. The attacker submits a scoring or reranking request with an X-Request-Id matching a victim's in-flight request. Timing matters because the overwrite must occur while the victim's documents are being scored, which places the attack in the race-condition category and keeps attack complexity high.

python

# Patch excerpt: vllm/entrypoints/pooling/scoring/serving.py
 from vllm.logger import init_logger
 from vllm.outputs import PoolingRequestOutput, ScoringRequestOutput
 from vllm.tasks import SCORE_TYPE_MAP, SupportedTask
+from vllm.utils import random_uuid
 from vllm.v1.pool.late_interaction import (
     build_late_interaction_doc_params,
     build_late_interaction_query_params,

python

# Patch excerpt: vllm/entrypoints/pooling/typing.py
     ## for flash-late-interaction
     query_final_res_batch: list[PoolingRequestOutput] | None = None
+    late_interaction_query_keys: list[str] | None = None

Source: GitHub Commit ee17d0d. The fix introduces random_uuid imports and a server-managed late_interaction_query_keys list so cache keys no longer depend on client-supplied headers.

Detection Methods for CVE-2026-105755

Indicators of Compromise

Multiple concurrent requests to /score or /rerank presenting identical X-Request-Id values from different source identities.
Elevated rates of late-interaction cache-miss errors in vLLM worker logs.
Unexpected ranking or scoring results reported by downstream applications consuming vLLM output.

Detection Strategies

Inspect reverse-proxy and API-gateway logs for duplicate X-Request-Id values across distinct client sessions within short time windows.
Correlate vLLM server error logs referencing late-interaction cache misses with inbound request metadata to identify header collisions.
Baseline normal X-Request-Id entropy and alert when values repeat across tenants or sessions.

Monitoring Recommendations

Enforce gateway-side rewriting of X-Request-Id to a server-generated value before requests reach vLLM.
Track per-endpoint error rates for /score and /rerank and alert on anomalies that may indicate concurrent cache contention.
Capture full request headers in audit logs for the scoring APIs to support post-incident forensics.

How to Mitigate CVE-2026-105755

Immediate Actions Required

Upgrade vLLM to version 0.30.0 or later, which replaces the client-controlled key with a server-generated identifier.
Restrict network exposure of the /score and /rerank endpoints to trusted clients only.
Review API gateway configuration to overwrite inbound X-Request-Id headers with a trusted, unique value.

Patch Information

The fix is included in GitHub Release v0.30.0 and implemented in GitHub Pull Request #51445 and GitHub Commit ee17d0d. Additional context is available in the GitHub Security Advisory GHSA-2phq-3phc-84px.

Workarounds

Deploy an upstream proxy that strips or regenerates X-Request-Id before forwarding requests to vLLM workers.
Disable or firewall the flash late-interaction scoring endpoints until the upgrade is applied.
Require authenticated, per-tenant isolation so concurrent requests from different tenants cannot reach the same worker cache.

bash

# Example NGINX directive to override client-supplied request identifiers
location /score {
    proxy_set_header X-Request-Id $request_id;
    proxy_pass http://vllm_backend;
}

location /rerank {
    proxy_set_header X-Request-Id $request_id;
    proxy_pass http://vllm_backend;
}