Dependency Confusion in vLLM Docker Image

Executive Summary

The vulnerability affects vLLM, an inference and serving engine for large language models, specifically versions prior to 0.22.1. The issue arises from a dependency confusion attack involving the flashinfer-jit-cache package. This package is installed from a custom index but was not registered on the official PyPI repository. Because the global setting UV_INDEX_STRATEGY="unsafe-best-match" is enabled, an attacker can register a malicious version of flashinfer-jit-cache on PyPI. During the Docker build process, this malicious package can execute arbitrary code as root, compromising the container images.

This attack allows the attacker to backdoor every resulting container image, potentially leading to exfiltration of sensitive data such as user prompts, API credentials, and model data from production vLLM deployments. The vulnerability was fixed in version 0.22.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized execution of code with root privileges during the Docker build process. An attacker can implant backdoors in container images, which compromises the security and integrity of your deployments.

• Exfiltration of all user prompts
• Theft of API credentials
• Exposure of model data from production vLLM deployments

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade vLLM to version 0.22.1 or later, where the issue has been fixed.

Avoid using the vulnerable Dockerfile versions prior to 0.22.1 that install the flashinfer-jit-cache package from an untrusted custom index with unsafe index strategy settings.

Ensure that package installations do not rely on unregistered or unverified packages from custom indexes to prevent dependency confusion attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to execute arbitrary code as root during the Docker build process, potentially backdooring container images. This can lead to exfiltration of all user prompts, API credentials, and model data from production vLLM deployments.

Such unauthorized access and data exfiltration could result in violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over personal and sensitive data to prevent unauthorized disclosure.

Therefore, exploitation of this vulnerability could compromise compliance with these regulations by exposing sensitive data and failing to maintain adequate security controls.

Useful 0 Not Useful 0

Detection Guidance

To detect the CVE-2026-54232 vulnerability on your system, you should check the version of the vLLM Docker images you are using. Versions prior to 0.22.1 are vulnerable.

You can inspect your Docker images to see if they were built with a vulnerable version of the vLLM Dockerfile by checking the image tags or labels.

Additionally, you can look for the presence of the flashinfer-jit-cache package installed from PyPI instead of the custom index, which indicates a potential compromise.

• Run `docker images` to list your Docker images and check their tags for vLLM versions.
• Use `docker history <image_name>:<tag>` to inspect the build steps of the image and verify if the flashinfer-jit-cache package was installed.
• Check installed Python packages inside a running container with `docker run --rm <image_name>:<tag> pip show flashinfer-jit-cache` to verify the source and version.
• Monitor network traffic for unexpected outbound connections that could indicate exfiltration of data.

Useful 0 Not Useful 0