CVE-2026-115912

What it actually does

Authenticated users can inject forged shared-memory address and monotonic_id values into multimodal features.kwargs_data; scale-out workers with shared-memory caching enabled blindly pass attacker bytes to pickle.loads(), enabling arbitrary Python code execution despite disabled insecure serialization.

Why it matters to the business

Compromises AI model inference clusters in multi-node deployments, risking theft of models and data, service disruption, and full infrastructure takeover; recent disclosure demands urgent action across organizations using vLLM.

How an attack unfolds

An authenticated attacker submits a multimodal inference request containing crafted kwargs_data that references attacker-controlled shared memory; trusting workers deserialize the supplied bytes via pickle.loads() and execute the resulting Python payload.

How to fix it

Upgrade every vLLM deployment to version 0.32.0 or later; until upgraded, disable shared-memory multimodal caching in all scale-out configurations.

How to confirm the fix worked

Confirm running version is 0.32.0 or newer via package metadata or startup logs; test that shared-memory caching is disabled or that forged kwargs_data no longer results in pickle execution.

Typical attack path

1. Obtain authenticated access to the vLLM API
2. Craft a multimodal request embedding forged shared-memory address and monotonic_id values pointing to attacker-controlled bytes
3. Submit the request to trigger worker-side processing
4. Workers call pickle.loads() on the supplied data
5. Attacker payload executes on the worker node

How to detect it

Search worker logs for multimodal requests containing unusual kwargs_data fields, unexpected pickle deserialization calls, or shared-memory address values that do not originate from internal caching logic.

What your security team should do

• Upgrade all vLLM instances to 0.32.0 within the next 48 hours given the five-day-old disclosure
• Temporarily disable shared-memory multimodal caching in distributed setups
• Add runtime checks or WAF rules to block suspicious multimodal feature payloads
• Review authentication boundaries to limit who can submit multimodal requests