Skip to content
vLLMPYSEC-2026-227

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the p

High8.8CVE-2026-54232 · Published Jun 22, 2026 · updated Jun 26, 2026

Source advisory

Affected versions

PackageAffectedFixed in
vllm
PyPI
< 0.22.10.22.1
Details and references

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
the CVSS score
Also known as
CVE-2026-54232, GHSA-jrf6-vqxq-pjv2

More vLLM advisories

All vLLM
DateAdvisory
Jun 17vLLM: OOM Denial of Service via Audio Decompression Bomb
CVE-2026-54233Medium6.5fixed in 0.24.0
Jun 17vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
CVE-2026-54236Medium5.3fixed in 0.24.0
Jun 17vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
CVE-2026-53923Medium7.5fixed in 0.24.0
Jun 17vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
CVE-2026-12491Medium4.8fixed in 0.24.0
Jun 17vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
CVE-2026-54235Medium6.5fixed in 0.24.0
Jun 16vLLM: OpenAI auth bypass
CVE-2026-48746Critical9.1fixed in 0.22.0

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.