Database/AI/ML frameworks & serving
vLLM: stale allowed_token_ids rows let one request constrain another tenant's output
Impact
InputBatch.condense() leaves stale allowed_token_ids rows behind when batch slots are recycled, so a token allowlist submitted by one request can silently apply to a different client's unconstrained request. The victim gets outputs shaped by someone else's constraint with no error and no sign that anything went wrong - a correctness and integrity problem in shared multi-tenant serving, not a crash. The advisory notes the attack can be driven through an unauthenticated /invocations endpoint where that is exposed. Requires concurrent constrained requests, so it is a race, not a deterministic exploit.
Who can reach it
Anyone who can submit concurrent generate requests with token constraints to the vLLM server, including unauthenticated callers where /invocations is reachable.
What to do
Upgrade to vLLM 0.31.0 or later and restart the serving processes. Where the upgrade has to wait, keep /invocations off untrusted networks and avoid co-batching requests from different tenants.
References
Related entries
- TrustyAI Service Operator: unauthenticated access to AI guardrail and orchestrator APIsCVE-2026-15044 · TrustyAI Service Operator (Red Hat OpenShift AI)Medium
- llama.cpp: oversized seq_id in a saved slot file leaks heap memory past the cells arrayCVE-2026-43630 · llama.cpp server (recurrent memory state slot-restore path)Medium
- vLLM: race in the prompt_embeds sparse-tensor guard reopens the CVE-2025-62164 crash pathCVE-2026-73557 · vLLM prompt_embeds loader (safe_load_prompt_embeds sparse-tensor guard)Medium
- Eclipse Che dashboard backend (POST /dashboard/api/data/resolver): The dashboard backend passes a user-supplied URLCVE-2026-86590 · Eclipse Che dashboard backend (POST /dashboard/api/data/resolver)Medium
- vLLM: allowed_token_ids validated against tokenizer length, corrupting shared GPU logit-bias stateCVE-2026-93840 · vLLM (SamplingParams allowed_token_ids validation / LogitBiasState)Medium
- vLLM: unbounded prompt token ids write out of bounds in the penalty bincount Triton kernelCVE-2026-93841 · vLLM (Triton _bincount_kernel, penalty prompt-presence bitset)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.