Cloudanix VulnDB

CVE-2026-7141

Medium · 5.6

CVSS

5.6

EPSS

0.3%

Published

Apr 27, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A disputed flaw in an AI model serving system could let remote attackers see small amounts of leftover data or get slightly different answers from the same question, though experts disagree whether the behavior is actually a security problem.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

Manipulation of the has_mamba_layers function in the KV Block Handler triggers use of an uninitialized resource, allowing remote attackers to influence memory contents that may leak limited data or alter computation results.

Why it matters to the business

Organizations running vLLM inference servers face a low-probability risk of unintended data exposure or non-deterministic model outputs that could affect reproducibility, compliance, or downstream decision quality; the issue remains disputed and has no vendor fix available.

How an attack unfolds

An attacker sends crafted remote requests that trigger specific batching behavior in the KV cache interface; because the server groups concurrent requests into varying input shapes, different kernels execute and produce differing results from rounding and operation order, potentially surfacing uninitialized data. Public proof-of-concept code exists but the root cause is contested as expected nondeterministic behavior.

How to fix it

No official fixed version is available; set the environment variable VLLM_BATCH_INVARIANT=1 on all inference servers to enforce deterministic kernels when temperature is 0.0, monitor upstream vLLM releases for a future resolution, and consider isolating or rate-limiting public endpoints until the dispute is resolved.

How to confirm the fix worked

Run identical temperature-0.0 prompts with and without VLLM_BATCH_INVARIANT=1 and compare output tensors for bitwise equality; inspect KV cache initialization paths in vllm/v1/kv_cache_interface.py for uninitialized allocations during batching; re-test after any future patch.

Typical attack path

  1. Identify a reachable vLLM endpoint running version 0.19.0 or earlier
  2. Craft and send concurrent inference requests timed to induce specific batch grouping
  3. Observe differences in output tensors or memory artifacts caused by uninitialized resource usage
  4. Extract any leaked residual data or confirm nondeterministic behavior for follow-on attacks

How to detect it

Search application and inference logs for repeated concurrent request patterns that produce varying outputs on identical prompts; look for use of the KV cache interface under high batch variability; review any public exploit artifacts that target the has_mamba_layers function.

What your security team should do

  • Immediately enable VLLM_BATCH_INVARIANT=1 in production inference workloads that require reproducibility
  • Restrict network access to vLLM servers to trusted clients only
  • Track the vLLM issue tracker and upgrade as soon as a confirmed fix is released
  • Add monitoring for unexpected output variance in critical pipelines

The record

A vulnerability was found in vLLM up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The existence of this vulnerability is still disputed at present. The proposed patch did not fix the issue. A 3rd party explains: "The divergence could be explained by a benign and expected vLLM behavior where vLLM server could group concurrent requests together resulting in different input shapes based on varying request arrival time. The differences in grouped input shapes could call different kernels with could produce difference results due to rounding and differences in order of operations. There is an environment variable VLLM_BATCH_INVARIANT=1 for users that desire to have deterministic output with temperature 0.0."

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities