vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the p
High8.8CVE-2026-54232 · Published Jun 22, 2026 · updated Jun 26, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vllm PyPI | < 0.22.1 | 0.22.1 |
Details and references
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- the CVSS score
- Also known as
- CVE-2026-54232, GHSA-jrf6-vqxq-pjv2
More vLLM advisories
All vLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 17 | vLLM: OOM Denial of Service via Audio Decompression Bomb CVE-2026-54233Medium6.5fixed in 0.24.0 | Medium6.5 | 0.24.0 |
| Jun 17 | vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router CVE-2026-54236Medium5.3fixed in 0.24.0 | Medium5.3 | 0.24.0 |
| Jun 17 | vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving CVE-2026-53923Medium7.5fixed in 0.24.0 | Medium7.5 | 0.24.0 |
| Jun 17 | vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations CVE-2026-12491Medium4.8fixed in 0.24.0 | Medium4.8 | 0.24.0 |
| Jun 17 | vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels CVE-2026-54235Medium6.5fixed in 0.24.0 | Medium6.5 | 0.24.0 |
| Jun 16 | vLLM: OpenAI auth bypass CVE-2026-48746Critical9.1fixed in 0.22.0 | Critical9.1 | 0.22.0 |