vLLM Cache Aliasing Flaw Before 0.31.0

Executive Summary

CVE-2026-114054 is a cache aliasing vulnerability in vLLM versions before 0.31.0. It allows authenticated attackers to manipulate shared cache keys using caller-controlled values like EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another user's cached processed media or match cache_salt to a LoRA name to reuse first-block KV state.

Useful 0 Not Useful 0

Detection Guidance

Check vLLM version with pip show vllm. If version is below 0.31.0, the system is vulnerable. Review cache key generation logic for EXIF ImageID and cache_salt usage in multimodal and prefix-cache components.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to cached data, information disclosure, or state integrity failures. Attackers might intercept or manipulate cached responses, potentially exposing sensitive data or causing incorrect processing of requests.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or information disclosure due to cache key collisions, which may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information). Unauthorized reuse of cached data could expose sensitive user information to unintended parties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.31.0 or higher immediately. Audit cache key generation to ensure caller-controlled values like EXIF ImageID and cache_salt are not used directly. Implement strict input validation for cache keys.

Useful 0 Not Useful 0