Description
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.
Published: 2026-10-05
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Leakage via Tenant Isolation Bypass
Action: Patch
AI Analysis

Impact

An authenticated tenant can reconstruct another tenant’s low‑entropy post‑tool history and submit the same continuation, causing the system to store the prefix in the unsalted global cache. By inspecting the cached_tokens_per_turn counter, the attacker learns whether that prefix was previously processed, revealing the existence of data for another tenant. This demonstrates a prefix‑cache membership oracle that breaks the intended isolation and can be used to infer confidential information about other tenants.

Affected Systems

vLLM vllm prior to version 0.30.0. The flaw resides in Harmony tool continuations handled by the POST /v1/responses endpoint and is mitigated by the 0.30.0 release.

Risk and Exploitability

The CVSS score of 3.1 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the API and the ability to submit tailored continuations; no public remote exploit has been reported. The risk is therefore limited to environments that expose authenticated API access and use the default prefix‑caching configuration.

Generated by OpenCVE AI on October 5, 2026 at 23:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to vllm v0.30.0 or later to remove the cache_salt handling bug.
  • Disable or restrict the use of the unsalted global prefix cache by configuring the application to enforce salted caching for all tenants.
  • Restrict authenticated API access to trusted users and monitor usage logs for abnormal cache access patterns that might indicate a membership oracle attempt.

Generated by OpenCVE AI on October 5, 2026 at 23:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-935w-9g4m-p28p vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
History

Thu, 08 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Vllm
Vllm vllm
CPEs cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
Vendors & Products Vllm
Vllm vllm

Tue, 06 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 05 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Vllm-project
Vllm-project vllm
Vendors & Products Vllm-project
Vllm-project vllm

Mon, 05 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.
Title vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
Weaknesses CWE-200
CWE-524
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Vllm Vllm
Vllm-project Vllm
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-06T14:48:10.692Z

Reserved: 2026-10-05T19:11:07.947Z

Link: CVE-2026-105752

cve-icon Vulnrichment

Updated: 2026-10-06T14:35:29.841Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-05T23:17:01.710

Modified: 2026-10-08T01:29:51.587

Link: CVE-2026-105752

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-05T22:32:59Z

Links: CVE-2026-105752 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T00:00:18Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-524

    Use of Cache Containing Sensitive Information