CVE catalog
CVE-2026-105752
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input withou
- Severity
- Low · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.22% · Oct 25, 2026
A flaw was found in vLLM. When multi-turn requests using tool continuations are processed, the service fails to retain the cache salt parameter, causing cached data to be placed in a shared, unsalted cache namespace rather than an isolated tenant cache. An authenticated tenant with knowledge of a victim's interaction history can submit matching requests and observe token cache statistics. This vulnerability results in cross-tenant information disclosure, allowing an attacker to confirm whether specific prompts or inputs were previously processed by other users. vllm: vLLM: Cross-tenant information disclosure via missing cache salt in tool continuations A low severity flaw was found in vLLM, the LLM inference and serving engine shipped in Red Hat AI Inference Server 3 and Red Hat OpenShift AI (RHOAI). When a multi-turn request submitted through the /v1/responses endpoint uses a tool continuation, vLLM rebuilds the next-turn engine input without preserving the cache_salt value, so the continuation prefix is cached in the shared, unsalted namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct another tenant's low-entropy post-tool history can submit the same continuation and use the per-turn cached-token counts reported in the response usage to determine whether that prefix was previously processed, defeating the tenant isolation that salted prefix caching is intended to provide. The resulting cross-tenant information disclosure is limited to confirming whether specific prompts or inputs were previously processed by another user; prompt content is not directly disclosed. Exploitation requires several specific preconditions, including an operator-enabled tool server, a victim request that sets cache_salt and triggers a tool continuation, and sufficiently accurate reconstruction of the victim's post-tool history. Both the Red Hat and upstream assessments rate this flaw Low severity (CVSS 3.1 score 3.1, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Because this flaw is rated Low impact, the fix for the affected Red Hat AI Inference Server 3 and Red Hat OpenShift AI releases is deferred, as Red Hat does not file trackers for Low severity flaws; the residual risk is that an authenticated user of a multi-tenant deployment with prefix caching enabled could infer whether specific inputs of another tenant were processed. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | vllm | Not reported | 0.30.0 | fixed |
| PyPI | vllm | Not reported | 0.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.0 | vulnerable |
| PyPI | vllm | Not reported | 0.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.2 | vulnerable |
| PyPI | vllm | Not reported | 0.1.3 | vulnerable |
| PyPI | vllm | Not reported | 0.1.4 | vulnerable |
| PyPI | vllm | Not reported | 0.1.5 | vulnerable |
| PyPI | vllm | Not reported | 0.1.6 | vulnerable |
| PyPI | vllm | Not reported | 0.1.7 | vulnerable |
| PyPI | vllm | Not reported | 0.10.0 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.2 | vulnerable |
| PyPI | vllm | Not reported | 0.11.0 | vulnerable |
| PyPI | vllm | Not reported | 0.11.1 | vulnerable |
| PyPI | vllm | Not reported | 0.11.2 | vulnerable |
| PyPI | vllm | Not reported | 0.12.0 | vulnerable |
| PyPI | vllm | Not reported | 0.13.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.1 | vulnerable |
| PyPI | vllm | Not reported | 0.15.0 | vulnerable |
| PyPI | vllm | Not reported | 0.15.1 | vulnerable |
| PyPI | vllm | Not reported | 0.16.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.1 | vulnerable |
| PyPI | vllm | Not reported | 0.18.0 | vulnerable |
| PyPI | vllm | Not reported | 0.18.1 | vulnerable |
| PyPI | vllm | Not reported | 0.19.0 | vulnerable |
| PyPI | vllm | Not reported | 0.19.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.0 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.2 | vulnerable |
| PyPI | vllm | Not reported | 0.2.3 | vulnerable |
| PyPI | vllm | Not reported | 0.2.4 | vulnerable |
| PyPI | vllm | Not reported | 0.2.5 | vulnerable |
| PyPI | vllm | Not reported | 0.2.6 | vulnerable |
| PyPI | vllm | Not reported | 0.2.7 | vulnerable |
| PyPI | vllm | Not reported | 0.20.0 | vulnerable |
| PyPI | vllm | Not reported | 0.20.1 | vulnerable |
| PyPI | vllm | Not reported | 0.20.2 | vulnerable |
| PyPI | vllm | Not reported | 0.21.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.1 | vulnerable |
| PyPI | vllm | Not reported | 0.23.0 | vulnerable |
| PyPI | vllm | Not reported | 0.24.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.1 | vulnerable |
| PyPI | vllm | Not reported | 0.26.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.1 | vulnerable |
| PyPI | vllm | Not reported | 0.28.0 | vulnerable |
| PyPI | vllm | Not reported | 0.29.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.1 | vulnerable |
| PyPI | vllm | Not reported | 0.3.2 | vulnerable |
| PyPI | vllm | Not reported | 0.3.3 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.2 | vulnerable |
| PyPI | vllm | Not reported | 0.4.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.2 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.4 | vulnerable |
| PyPI | vllm | Not reported | 0.5.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.0 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.0 | vulnerable |
| PyPI | vllm | Not reported | 0.7.1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.2 | vulnerable |
| PyPI | vllm | Not reported | 0.7.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.0 | vulnerable |
| PyPI | vllm | Not reported | 0.8.1 | vulnerable |
| PyPI | vllm | Not reported | 0.8.2 | vulnerable |
| PyPI | vllm | Not reported | 0.8.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.4 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.2 | vulnerable |
| PyPI | vllm | Not reported | 0.30.0 | fixed |
| PyPI | vllm | Not reported | 0.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.0 | vulnerable |
| PyPI | vllm | Not reported | 0.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.1.2 | vulnerable |
| PyPI | vllm | Not reported | 0.1.3 | vulnerable |
| PyPI | vllm | Not reported | 0.1.4 | vulnerable |
| PyPI | vllm | Not reported | 0.1.5 | vulnerable |
| PyPI | vllm | Not reported | 0.1.6 | vulnerable |
| PyPI | vllm | Not reported | 0.1.7 | vulnerable |
| PyPI | vllm | Not reported | 0.10.0 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.1.1 | vulnerable |
| PyPI | vllm | Not reported | 0.10.2 | vulnerable |
| PyPI | vllm | Not reported | 0.11.0 | vulnerable |
| PyPI | vllm | Not reported | 0.11.1 | vulnerable |
| PyPI | vllm | Not reported | 0.11.2 | vulnerable |
| PyPI | vllm | Not reported | 0.12.0 | vulnerable |
| PyPI | vllm | Not reported | 0.13.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.0 | vulnerable |
| PyPI | vllm | Not reported | 0.14.1 | vulnerable |
| PyPI | vllm | Not reported | 0.15.0 | vulnerable |
| PyPI | vllm | Not reported | 0.15.1 | vulnerable |
| PyPI | vllm | Not reported | 0.16.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.0 | vulnerable |
| PyPI | vllm | Not reported | 0.17.1 | vulnerable |
| PyPI | vllm | Not reported | 0.18.0 | vulnerable |
| PyPI | vllm | Not reported | 0.18.1 | vulnerable |
| PyPI | vllm | Not reported | 0.19.0 | vulnerable |
| PyPI | vllm | Not reported | 0.19.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.0 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.2.2 | vulnerable |
| PyPI | vllm | Not reported | 0.2.3 | vulnerable |
| PyPI | vllm | Not reported | 0.2.4 | vulnerable |
| PyPI | vllm | Not reported | 0.2.5 | vulnerable |
| PyPI | vllm | Not reported | 0.2.6 | vulnerable |
| PyPI | vllm | Not reported | 0.2.7 | vulnerable |
| PyPI | vllm | Not reported | 0.20.0 | vulnerable |
| PyPI | vllm | Not reported | 0.20.1 | vulnerable |
| PyPI | vllm | Not reported | 0.20.2 | vulnerable |
| PyPI | vllm | Not reported | 0.21.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.0 | vulnerable |
| PyPI | vllm | Not reported | 0.22.1 | vulnerable |
| PyPI | vllm | Not reported | 0.23.0 | vulnerable |
| PyPI | vllm | Not reported | 0.24.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.0 | vulnerable |
| PyPI | vllm | Not reported | 0.25.1 | vulnerable |
| PyPI | vllm | Not reported | 0.26.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.0 | vulnerable |
| PyPI | vllm | Not reported | 0.27.1 | vulnerable |
| PyPI | vllm | Not reported | 0.28.0 | vulnerable |
| PyPI | vllm | Not reported | 0.29.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.0 | vulnerable |
| PyPI | vllm | Not reported | 0.3.1 | vulnerable |
| PyPI | vllm | Not reported | 0.3.2 | vulnerable |
| PyPI | vllm | Not reported | 0.3.3 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0 | vulnerable |
| PyPI | vllm | Not reported | 0.4.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.1 | vulnerable |
| PyPI | vllm | Not reported | 0.4.2 | vulnerable |
| PyPI | vllm | Not reported | 0.4.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0 | vulnerable |
| PyPI | vllm | Not reported | 0.5.0.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.2 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3 | vulnerable |
| PyPI | vllm | Not reported | 0.5.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.5.4 | vulnerable |
| PyPI | vllm | Not reported | 0.5.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.0 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.1.post2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.2 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3 | vulnerable |
| PyPI | vllm | Not reported | 0.6.3.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4 | vulnerable |
| PyPI | vllm | Not reported | 0.6.4.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.6.5 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6 | vulnerable |
| PyPI | vllm | Not reported | 0.6.6.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.0 | vulnerable |
| PyPI | vllm | Not reported | 0.7.1 | vulnerable |
| PyPI | vllm | Not reported | 0.7.2 | vulnerable |
| PyPI | vllm | Not reported | 0.7.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.0 | vulnerable |
| PyPI | vllm | Not reported | 0.8.1 | vulnerable |
| PyPI | vllm | Not reported | 0.8.2 | vulnerable |
| PyPI | vllm | Not reported | 0.8.3 | vulnerable |
| PyPI | vllm | Not reported | 0.8.4 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5 | vulnerable |
| PyPI | vllm | Not reported | 0.8.5.post1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0 | vulnerable |
| PyPI | vllm | Not reported | 0.9.0.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.1 | vulnerable |
| PyPI | vllm | Not reported | 0.9.2 | vulnerable |
| PyPI | vllm | Not reported | 0.30.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | vllm | cpe | Not reported | 0.30.0 | Not reported | NVD-CVE-2026-105752 | Not reported |
| PyPI | vllm | PyPI | Not reported | 0.30.0 | Not reported | PYSEC-2026-4308 | Not reported |
| PyPI | vllm | PyPI | Not reported | 0.30.0 | Not reported | GHSA-935W-9G4M-P28P | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://github.com/advisories/GHSA-935w-9g4m-p28p]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-105752]
- [https://osv.dev/vulnerability/PYSEC-2026-4308]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105752.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3564.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]