HighVulnerabilityCVE-2026-115912updated 28 Oct 2026, 21:15 UTC

vLLM can run attacker code via forged multimodal cache data

Someone who can send requests to a vLLM server can craft a request that makes the server run their own code. It works even when the server's safety setting for unsafe data is off.

Fixed in vLLM 0.32.0Official, 2 sources

Severity	HighCVSS 7.5 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	YesvLLM 0.32.0 · since 28 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1Authenticated callerSends crafted public API requests
2Forged cache referenceFake address in kwargs_data is trusted
3Malicious bytes loadedWorker calls pickle.loads on attacker bytes
ResultAttacker runs Python code on the server

What happened

vLLM's shared-memory multimodal cache trusts address and monotonic_id values supplied in the public request field features.kwargs_data; workers then pass attacker-chosen bytes to pickle.loads(), enabling arbitrary Python execution.

Why it is dangerous: An attacker with API access can run arbitrary code on the inference workers, potentially taking over the server and any data or credentials it holds. Scale-out deployments with shared-memory multimodal caching enabled are most exposed.

Are you affected?

You are affected if you run vLLM below 0.32.0 in scale-out mode with --mm-processor-cache-type shm enabled and the API is reachable by callers you don't fully trust.

Package / product	Affected versions	Fixed in
vllm · pip	< 0.32.0	0.32.0

What to do

Update vLLM to 0.32.0 or later
Until updated, disable shared-memory multimodal caching by not using --mm-processor-cache-type shm
Restrict network access to the vLLM API to trusted clients only

Timeline

26 Oct 2026, 17:17 UTC
Publicly disclosed
26 Oct 2026, 17:17 UTC
Reported by NVD · NVD
26 Oct 2026, 17:21 UTC
Picked up by Zero Radar
28 Oct 2026, 21:15 UTC
GitHub Advisory reported on it · GitHub Advisory
28 Oct 2026, 21:15 UTC
Fixed version published: vllm 0.32.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-115912NVD · 26 Oct 2026, 17:17 UTC
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledGitHub Advisory · 28 Oct 2026, 21:15 UTC

Technical details

ID: CVE-2026-115912 · GHSA-6757-hggm-hp2w
CVSS: 7.5 / 10
EPSS: 0.5% chance of exploitation within 30 days
Disclosed: 26 Oct 2026, 17:17 UTC
On Zero Radar: 26 Oct 2026, 17:21 UTC (5 min after disclosure)
Last change: 28 Oct 2026, 21:15 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works