Database/AI/ML frameworks & serving
vLLM (Mooncake ZMQ/TCP): Unsafe deserialization exposed on all interfaces
CVSS 10.0CVE-2025-32444AI/ML frameworks & servingcurated
Impact
Unsafe deserialization exposed on all interfaces → RCE
Who can reach it
Unauthenticated network from any host on the cluster fabric
What to do
Upgrade to 0.8.5+. Highest-severity vLLM issue; assume any pre-0.8.5 disaggregated deployment is compromised
References
Related entries
- ChromaDB: Pre-authentication code injectionCVE-2026-45829 · ChromaDBCritical
- Kubeflow Pipelines frontend: unauthenticated SSRF proxy reaches cloud metadata and cluster-internal APIsCVE-2026-54745 · Kubeflow Pipelines frontend (/_proxy/ route in proxy-middleware.ts)Critical
- Xinference: unauthenticated chat request reaches eval() in the Llama3 tool-call parserCVE-2026-61539 · Xinference (Llama3 tool-call parser, `_eval_llama3_chat_arguments`)Critical
- Decepticon: unfiltered ChatML special tokens in crawl results give a target page control of the agentCVE-2026-61732 · Decepticon (LLM message construction from crawl output)Critical
- ClearML web server: XSSCVE-2024-24594 · ClearML web serverCritical
- Red Hat OpenShift AI (notebook plane): A low-privileged data-scientist account can escalate to full cluster compromiseCVE-2025-10725 · Red Hat OpenShift AI (notebook plane)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.