CVE catalog

CVE-2026-54232

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package.

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.56% · Oct 25, 2026

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpevllmNot reported0.22.1fixed
CpevllmNot reported0.22.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpevllmcpeNot reported0.22.1Not reportedNot reportedNot reported
CpevllmcpeNot reported0.22.1Not reportedNVD-CVE-2026-54232Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]