The vulnerability arises from a cross‑request mask leak in vLLM’s InputBatch.condense() routine. When allowed_token_ids rows are not cleared between requests, a malicious actor can set a restrictive token allowlist that remains in place for the next request handled by the same batch slot. The attacker can therefore force another client’s output to be constrained or altered, effectively tampering with the result data. This flaw corresponds to CWE‑440 and CWE‑459, representing an improper restriction of operations within a trusted domain and the persistent use of state between user sessions.

Any deployment of the vllm-project vllm library running a version prior to 0.31.0, regardless of operating system or environment, is vulnerable. The vulnerability is triggered through the public /invocations endpoint, so deployments that expose this endpoint to unauthenticated users are directly impacted.

With a CVSS score of 6.3 the flaw presents moderate severity. The EPSS score of less than 1 % indicates a very low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. However, the flaw can be exploited remotely via concurrent generate requests on the unauthenticated /invocations endpoint, allowing attackers to influence other users’ outputs without needing elevated privileges. The attack path involves submitting a constrained request that sets stale allowed_token_ids; the server then re‑uses the same batch slot for a later, unrestricted request, leaking the mask to the victim.