vLLM: unvalidated MoRIIO ack fields let a remote client exhaust resources on a serving node

Impact

The MoRIIO KV-transfer connector in vLLM 0.26.0/0.27.0 accepts attacker-controlled request_id and kv_transfer_params values in its acknowledgement/release path, and manipulation leads to uncontrolled resource consumption on the serving process. On a GPU node this is availability damage where it hurts most: the engine holds the GPUs, so a wedged or memory-starved vLLM process idles expensive accelerators until it is restarted, and a disaggregated prefill/decode deployment exposes the connector between pods rather than only to a single trusted caller. The record reports availability impact only - no confidentiality or integrity loss. The project was notified through a pull request and, per the record, had not shipped a fix at publication.

Who can reach it

Remote, no authentication stated, for anyone who can reach the vLLM MoRIIO connector endpoint - in practice any workload on the network segment carrying KV transfer traffic between prefill and decode workers.

What to do

No fixed release is named in the record; PR vllm-project/vllm#50674 is the proposed fix and had not been merged. Until a release lands, keep MoRIIO KV transfer off unless it is needed, and restrict the connector's network reachability to the serving pods that must speak it. Applying a fix once released means restarting the vLLM engine, which drops in-flight requests and reloads model weights onto the GPUs - schedule it like any serving-daemon restart.

References

Related entries

• ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium
• NVIDIA OpenShell: sandbox exec handler is vulnerable to OS command injection, breaking the sandbox boundaryCVE-2026-65086 · NVIDIA OpenShell for Linux (sandbox exec handler)Medium
• Hugging Face Transformers: checkpoint index shard names traverse out of the model directoryCVE-2026-75104 · Hugging Face Transformers (checkpoint shard index filename handling)Medium
• LangGraph.js MongoDB checkpointer: NoSQL injection in thread ids leaks checkpoints across tenantsCVE-2026-48121 · @langchain/langgraph-checkpoint-mongodb (MongoDBSaver.getTuple checkpoint lookup)Medium
• Ollama: DNS rebinding grants a remote page full API accessCVE-2024-28224 · OllamaMedium
• Dagster (gRPC `get_notebook_data`): Local file inclusion — read arbitrary filesCVE-2025-51481 · Dagster (gRPC `get_notebook_data`)Medium