Findings

CVE-2026-105754

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Published Oct 5, 2026 · updated Oct 15, 2026

## Affected - **Ecosystem / package:** pip / - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit [ ](https://github.com/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34)). The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. ## Summary vLLM's disaggregated **scale-out** transport splits a multimodal request into a trusted render step ( ) and a separate generate step ( ). The generate route decodes a caller-supplied object — serialized encoder tensors ( ), multimodal hashes ( ), placeholder ranges ( ), and the internal field-processor selection — and forwards it into the engine **as if it had come from the trusted renderer**, with no rebinding to (or validation against) the active model's renderer contract. Because the two routes are ordinary auth-guarded HTTP endpoints (the prefix is registered by default on generate-capable servers), any authenticated caller can submit an otherwise-valid render body with a single forged field. Depending on which field is forged, this produces: - an **engine-fatal crash** of the shared EngineCore process (denial of service), reproduced as a CUDA illegal-memory-access, a post-admission rank-mismatch , and a hard — three independent forged fields (sites 1, 2, 3); - **silent cross-request encoder-cache poisoning / disclosure** of shared encoder state when the cache-key hash is not bound to the payload (site 4); - **transport-level integrity loss** when sparse placeholder masks are dropped during render-to-generate replay (site 5). All five share one root cause and one fix shape: the reconstructed multimodal state on the scale-out path is trusted without being rebound to, and validated against, the active model's renderer output before it reaches the engine. These sites are distinct from prior multimodal hardening. Site 1 survives [GHSA-wv77-2vpf-vmmg](https://github.com/vllm-project/vllm/security/advisories/GHSA-wv77-2vpf-vmmg) (that fix validates ful