Inclusion of Sensitive Information in Log Files in vLLM - CVE-2026-54236

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into an error message in the Anthropic API router and realtime speech-to-text error-handling paths when processing malformed image data or other input that triggers exceptions containing object representations. A remote attacker can send crafted requests or input that causes exceptions to be returned with unsanitized error messages to disclose sensitive information.

The issue leaks object representation memory addresses in response bodies, including through in-route HTTP exception handling, an SSE streaming converter, and WebSocket error paths that bypass the sanitizing exception handler chain.

Affected software

How to mitigate CVE-2026-54236

External References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hgg8-fqqc-vfmw
• https://github.com/vllm-project/vllm/blob/771e1e48b/vllm/entrypoints/anthropic/api_router.py#L78

Related Security Bulletins

• Multiple vulnerabilities in vLLM