CVE-2026-114054: Improper Access Control in vllm-project vllm

CVE-2026-114054 describes a cache aliasing vulnerability in vLLM prior to version 0.31.0. The flaw allows authenticated attackers to collide shared cache keys by providing caller-controlled inputs such as EXIF ImageID or cache_salt. By setting a UUID EXIF ImageID, an attacker can receive cached processed media from another request. Similarly, matching cache_salt to a LoRA name enables reuse of the first-block key-value state. This improper access control issue can lead to unauthorized data exposure within the caching mechanism.

The vulnerability enables authenticated attackers to access cached data belonging to other users or requests by exploiting cache key collisions. This can result in unauthorized disclosure of processed media or internal key-value state data. The CVSS 4.0 score of 7.1 indicates a high severity impact with network attack vector, low attack complexity, no user interaction, and high impact on data confidentiality.

A fix is available in vLLM version 0.31.0 and later. Users should upgrade to version 0.31.0 or above to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.