CVE-2026-105752: vLLM Package Vulnerability Leading to Cross-Tenant Cache Membership Oracle
Summary
CVE-2026-105752: Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit 752a3a504485). Affects vllm versions < 0.30.0. Fixed in 0.30.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient and scalable language model serving, particularly in the context of GPT-OSS applications. It allows users to leverage built-in tools and multi-turn interactions for generating responses. However, the library has a vulnerability that affects its ability to isolate cached data between different tenants, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the improper handling of the cache_salt parameter during tool continuations in the vLLM library. Specifically, when a multi-turn tool call is made, the initial request correctly includes the cache_salt, but subsequent tool continuations omit this parameter. This leads to the caching of sensitive data in a global unsalted namespace, allowing an attacker to infer whether a guessed prompt was processed by another tenant. The implications of this vulnerability are significant, as it undermines the isolation guarantees intended for multi-user environments, potentially exposing exact cached-token counts and enabling prompt membership oracle attacks.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.30.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.30.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Harmony tool path for multi-turn interactions until the package is updated. If you must use it, ensure that sensitive data is not included in the prompts to minimize the risk of exposure.
Conclusion
The vLLM package has a critical vulnerability that affects its ability to maintain data isolation between tenants. By updating to the latest version and following the recommended fixes, users can mitigate the risks associated with this vulnerability. Regular monitoring and vulnerability assessments are essential for maintaining application security.
See every vulnerability recorded for vllm →
FAQ
The vulnerability involves the dropping of the cache_salt during tool continuations, leading to potential cross-tenant data exposure.
Any authenticated tenant using the vLLM library in a shared deployment environment is at risk.
Attackers may be able to infer sensitive information about other tenants' prompts and cached data, undermining data isolation.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
