CVE-2026-105755

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id, cross-request integrity break and induced errors on /score and /rerank

# vllm/entrypoints/serve/engine/serving.py Lines 116-126
    @staticmethod
    def _base_request_id(
        raw_request: Request | None, default: str | None = None
    ) -> str | None:
        """Pulls the request id to use from a header, if provided"""
        if raw_request is not None and (
            (req_id := raw_request.headers.get("X-Request-Id")) is not None
        ):
            return req_id

        return random_uuid() if default is None else default

# vllm/entrypoints/pooling/scoring/serving.py Lines 207-212
        n_queries = ctx.n_queries
        n_docs = len(ctx.engine_inputs) - n_queries
        query_engine_inputs = ctx.engine_inputs[:n_queries]

        query_keys = [f"{ctx.request_id}-query-{i}" for i in range(n_queries)]
        query_uses = [n_docs if n_queries == 1 else 1] * n_queries

# vllm/v1/worker/gpu/pool/late_interaction_runner.py Lines 91-107
            if mode == LATE_INTERACTION_MODE_CACHE_QUERY:
                assert query_uses is not None
                # `output` can be a view into the current step's hidden-states
                # buffer, so clone it before storing across scheduling steps.
                self._query_cache[query_key] = output.clone()
                self._query_uses[query_key] = query_uses
                outputs[i] = torch.zeros((), device=output.device, dtype=torch.float32)
                continue

            if mode == LATE_INTERACTION_MODE_SCORE_DOC:
                query_output = self._query_cache.get(query_key)
                if query_output is None:
                    raise ValueError(
                        "late-interaction query cache miss for key "
                        f"{query_key!r}. Ensure query requests are executed "
                        "before their paired document requests."
                    )

A network client of the standard scoring API can, on a flash late-interaction /score or /rerank deployment:

1. Corrupt another user's results, by reusing the victim's X-Request-Id, the attacker's query embedding overwrites the victim's cached entry, so the victim's documents are scored against the attacker's query (a cross-request integrity break).
2. Induce errors, depending on timing, one request consumes the shared use counter and forces the other request into a late-interaction cache-miss error.

Both consequences follow deterministically from reusing the victim's header value, because same-key work is pinned to one engine. This is reachable through normal request handling and does not depend on any trusted inter-node network.

CVE-2026-105755 has a CVSS score of 4.2 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.30.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Derive the flash late-interaction query-cache key from a server-generated, unforgeable per-request identifier (a random_uuid() namespace) rather than the caller-supplied X-Request-Id, and thread that key through the PoolingServeContext to the doc-scoring pass so both passes reuse the same key and a caller cannot address another request's cache entry.

In vllm/entrypoints/pooling/scoring/serving.py, the encode-queries pass mints a fresh namespace and stashes the keys on the context:

-        query_keys = [f"{ctx.request_id}-query-{i}" for i in range(n_queries)]
+        query_namespace = random_uuid()
+        query_keys = [
+            f"late-interaction-{query_namespace}-query-{i}" for i in range(n_queries)
+        ]
+        ctx.late_interaction_query_keys = query_keys

and the encode-docs pass reads those stored keys instead of re-deriving them from ctx.request_id:

-        query_keys = [f"{ctx.request_id}-query-{i}" for i in range(n_queries)]
+        query_keys = ctx.late_interaction_query_keys
+        if query_keys is None:
+            raise RuntimeError("Late-interaction query keys were not initialized.")

This requires adding the late_interaction_query_keys: list[str] | None = None field to PoolingServeContext (vllm/entrypoints/pooling/typing.py). Because the namespace is a server-generated UUID, colliding X-Request-Id values no longer produce a shared cache key; a regression test asserting exactly that (colliding request ids yield distinct query-cache keys) accompanies the change.

1. What is CVE-2026-105755? CVE-2026-105755 is a medium-severity security vulnerability in vllm (pip), affecting versions < 0.30.0. It is fixed in 0.30.0.
2. How severe is CVE-2026-105755? CVE-2026-105755 has a CVSS score of 4.2 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of vllm are affected by CVE-2026-105755? vllm (pip) versions < 0.30.0 is affected.
4. Is there a fix for CVE-2026-105755? Yes. CVE-2026-105755 is fixed in 0.30.0. Upgrade to this version or later.
5. Is CVE-2026-105755 exploitable, and should I be worried? Whether CVE-2026-105755 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-105755 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-105755? Upgrade vllm to 0.30.0 or later.

Other vulnerabilities in vllm