CVE-2026-114054

vLLM shared-cache identifiers can collide across inputs or adapters

vLLM · Multimodal hasher and prefix cache

First documented disclosure · Review checkpoint

Summary

Two cache-key ambiguities can substitute processed media or reuse the wrong adapter state.

Severity and exploitation evidence

High · 7.1/10 · CVSS 4.0. Severity source.

Exploitation not established: The first-block cache hit was observed in a controlled GPU test. Neither reviewed path establishes malicious access to a customer deployment.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An image carrying a UUID object as its EXIF ImageID can be keyed by that identifier alone. Separately, a caller’s cache salt can collide with a static adapter name in an untyped prefix-cache key.

Conditions required

The image path requires matching UUID-valued metadata in the application representation. The prefix path requires prefix caching, a known adapter name and matching first-block tokens.

Potential impact

Potential cross-request media substitution and first-block KV state confusion. Complete prompt recovery and general disclosure of private images were not shown.

Affected versions and configurations

VulnCheck and the maintainer advisory list versions before 0.31.0. The reports test earlier builds, including 0.25.1.

Fix and mitigation status

The advisories list 0.31.0. PR 51899 fixes the prefix-cache collision but explicitly drops the EXIF change. The 0.31.0 and 0.33.0 tagged hashers retain the UUID shortcut. A fix for both paths was not verified.

Practical next steps

Upgrade for the prefix-cache fix. Isolate shared media caches or normalize trusted image objects at ingestion, and verify the image path used by your deployment.

Operating lesson

Bind cache keys to actual content and tag each part of a cache key with its purpose.

Evidence and limits

The June 6 public report covers the prefix collision. The October 6 advisory groups it with image aliasing. The review verified the image-identifier code in tagged source, but did not establish that an ordinary uploaded image can supply the required Python UUID object.

Sources