vLLM (API key comparison): Timing attack recovers the API key

Impact

Timing attack recovers the API key

Who can reach it

Unauthenticated network to the serving port

What to do

Upgrade to 0.11.0+; do not rely on vLLM's own API key as the tenant auth boundary — front it with a gateway

References

Related entries

• SGLang (`/server_info`): Endpoint returns API keys and SSL keyfile pathsCVE-2026-15977 · SGLang (`/server_info`)High
• SGLang (weight exfiltration): Two endpoints allow a remote attacker to pull model weights when no API key is setCVE-2026-15978 · SGLang (weight exfiltration)High
• NVIDIA Triton Inference Server: unauthenticated request triggers excessive iteration and hangs the serverCVE-2026-16497 · NVIDIA Triton Inference Server for LinuxHigh
• Keras (HDF5 external links): Arbitrary local file read during model loadCVE-2026-1669 · Keras (HDF5 external links)High
• OpenShift AI Data Science Pipelines Operator: predictable PRNG generates MariaDB and MinIO credentialsCVE-2026-18611 · Red Hat OpenShift AI Data Science Pipelines Operator (generated MariaDB and MinIO credentials)High
• MLflow: unauthenticated arbitrary file read via prompt-tagged model version source pathCVE-2026-2614 · MLflow tracking server (`_create_model_version` / model version artifact handler)High