vLLM: unregistered PyPI name in the official Dockerfile allows dependency confusion into built images

Impact

Anyone building vLLM's own container image before 0.22.1 pulls flashinfer-jit-cache through --extra-index-url with UV_INDEX_STRATEGY=unsafe-best-match, and the package name was never claimed on PyPI. Whoever registered the name on PyPI could have had arbitrary code run as root during the image build, leaving a backdoored serving image that an operator then rolls out across the GPU fleet. On an inference node that means the attacker sits inside the process holding the model weights and every prompt and API key passing through it, with GPU memory and the node's service credentials in reach. Because the compromise is baked into the image rather than into a running config, it survives pod restarts and spreads wherever that image tag is deployed.

Who can reach it

No access to the operator's environment is needed - the attacker only has to publish a package under the unclaimed name on public PyPI. The victim action is building (or pulling a build of) the vLLM Dockerfile; unauthenticated and remote with respect to the operator.

What to do

Rebuild images on vLLM 0.22.1 or later, which fixes the index handling, and redeploy serving pods from the new image; pin and verify the flashinfer index explicitly if you maintain a forked Dockerfile. Rolling the new image out is a serving-pod restart rather than a node reboot, but any image built from an affected Dockerfile should be treated as suspect and replaced, not patched in place. The advisory does not state that a malicious package was ever published.

References

Related entries

• vLLM (sparse tensor validation): Missing sparse-tensor invariant checks in multimodal embeddingsCVE-2026-56340 · vLLM (sparse tensor validation)High
• PraisonAI: file-tool path argument injects shell commands into the compute providerCVE-2026-57117 · PraisonAI LocalManagedAgent / SandboxedAgent (compute bridge file tools)High
• Ray (WebDataset reader): Unsafe deserializationCVE-2026-57516 · Ray (WebDataset reader)High
• Weaviate: RBAC role assignment does not verify the assigner holds the granted permissionsCVE-2026-59093 · WeaviateHigh
• LiteLLM Proxy: forged Authorization header reaches MCP tooling without a valid API keyCVE-2026-59822 · LiteLLM Proxy (MCP Streamable HTTP endpoint authentication)High
• NVIDIA OpenShell: a malicious gateway can inject OS commands into the connecting clientCVE-2026-65091 · NVIDIA OpenShell (gateway response handling)High