Input validation error in vLLM - CVE-2026-105754
Published: November 9, 2026
Vulnerability identifier: #VU162990
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105754
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker to crash vLLM's shared EngineCore process, denying model service to all tenants.
The vulnerability exists due to insufficient validation of caller-supplied multimodal features against the active model's renderer contract in the scale-out generate endpoint. An authenticated remote attacker can submit a single request containing forged multimodal metadata to /inference/v1/generate, triggering a fatal engine error in a scale-out multimodal deployment.
Affected software
vLLM
How to mitigate CVE-2026-105754
Install security update from vendor's website.
vLLM - update to 0.30.0