Database/AI/ML frameworks & serving
vLLM: caller-controlled EXIF ImageID and cache_salt collide cache keys across requests
Impact
Cache keys in vLLM before 0.31.0 are derived from values the caller supplies - the EXIF ImageID of an uploaded image, and cache_salt for the prefix KV cache. Setting a chosen UUID as EXIF ImageID returns another request's cached processed media, and matching cache_salt to a LoRA name reuses that adapter's first-block KV state. This is a cross-request confidentiality break inside one serving process, which matters most exactly where operators consolidate: a shared inference endpoint serving several tenants or several customer LoRAs on the same GPU leaks one caller's content to another, and no tenant boundary in the orchestration layer helps because the collision happens inside the engine's own cache.
Who can reach it
An authenticated API client of a shared vLLM endpoint that has media or prefix caching enabled. The attacker needs only the ability to set image EXIF fields or the cache_salt request field.
What to do
Upgrade vLLM to 0.31.0 or later and restart the serving processes. If an upgrade has to wait, stop sharing one vLLM process across trust boundaries - give each tenant its own replica - or disable the multimodal media cache and prefix caching, accepting the throughput loss. Strip EXIF from uploaded images and refuse client-supplied cache_salt at the gateway as a partial mitigation.
References
Related entries
- Flexible GraphRAG: Cypher injection through ingested document content on the FalkorDB backendCVE-2026-114510 · Flexible GraphRAG FalkorDBAdapter (_escape / add_graph_documents Cypher assembly)High
- vLLM: audio decompression bomb via input_audio or audio_url exhausts serving node memoryCVE-2026-116175 · vLLM (AudioMediaIO load_audio, missing max_duration_s limit)High
- vLLM: out-of-vocabulary stop_token_ids crash the engine and write past the V2 runner logits bufferCVE-2026-116181 · vLLM (OpenAI-compatible API, stop_token_ids validation)High
- NVIDIA TensorRT-LLM: server-side request forgery lets a local user make the serving process issue arbitrary requestsCVE-2026-24269 · NVIDIA TensorRT-LLM (server-side request forgery in the serving component)High
- vLLM (`MediaConnector`): SSRF, recurrence of CVE-2025-6242CVE-2026-24779 · vLLM (`MediaConnector`)High
- vLLM (`load_from_url_async`): Bypass of the CVE-2026-24779 SSRF fixCVE-2026-25960 · vLLM (`load_from_url_async`)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.