CVE-2026-105755: 
NixOS vulnerability analysis and mitigation

CVE-2026-105755 is a cross-request integrity vulnerability in vLLM, an inference and serving engine for large language models, affecting the flash late-interaction scoring endpoints (/score and /rerank). The vulnerability arises because each worker's query_key value is derived from the caller-controlled X-Request-Id HTTP header, allowing a concurrent request that reuses a victim's identifier to overwrite the cached query embedding. This means the victim's documents are scored against the attacker's query rather than their own. All vLLM versions prior to 0.30.0 are affected (confirmed on v0.25.1, commit 752a3a504485). The vulnerability was published on October 5, 2026, with a CVSS v3.1 base score of 4.2 (Medium) (Github Advisory, vllm Security Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-694 (Use of Multiple Resources with Duplicate Identifier). In vllm/entrypoints/serve/engine/serving.py, the _base_request_id() method copies the X-Request-Id header directly from the incoming HTTP request without any server-side validation or isolation. The flash late-interaction path in vllm/entrypoints/pooling/scoring/serving.py then constructs worker cache keys as f"{ctx.request_id}-query-{i}", and the data-parallel router in vllm/v1/pool/late_interaction.py pins all requests sharing a query_key to the same engine via crc32(query_key), making collisions deterministic. The worker stores query embeddings in a process-local cache (self._query_cache[query_key]) with no ownership check, so a colliding key either returns another request's cached query embedding or raises a cache-miss error when the shared use counter is exhausted. This bug is specific to the flash late-interaction path; non-flash late-interaction scoring is not affected (Github Advisory, vllm Security Advisory).

A network-authenticated attacker can corrupt another user's scoring results by sending concurrent requests to /score or /rerank endpoints with the victim's X-Request-Id header value, causing the victim's documents to be scored against the attacker's query instead of their own — a cross-request integrity break. In a demonstrated reproduction, a victim's normal score of 369.72 became 5.02 during a collision, exactly matching the attacker's query score. Additionally, depending on timing, the attacker can consume the shared use counter and force the victim's request into a late-interaction cache-miss error, degrading service availability. There is no confidentiality impact (the attacker does not learn the victim's query or documents), and the server itself remains healthy (Github Advisory, vllm PR #51445).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). Exploitation requires the attacker to have low-privilege network access to the vLLM API and knowledge of (or ability to guess) a victim's X-Request-Id header value, plus winning a concurrency race — making the attack complexity high. The EPSS score is approximately 0.20% (9th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a vLLM deployment (prior to v0.30.0) with flash late-interaction enabled on /score or /rerank endpoints, which is the default for supported models. Obtain or observe a victim's X-Request-Id header value (e.g., via shared infrastructure, logs, or network interception).
2. Craft malicious request: Prepare a concurrent HTTP POST request to the same /score or /rerank endpoint, setting the X-Request-Id header to match the victim's identifier and supplying the attacker's own query payload.
3. Race condition exploitation: Send the attacker's request concurrently with the victim's request. Because the data-parallel router pins all requests sharing a query_key (derived via crc32(query_key)) to the same engine, the collision is deterministic once the header value matches.
4. Cache overwrite: The attacker's request causes the worker to overwrite the victim's cached query embedding (self._query_cache[query_key]) with the attacker's query embedding before the victim's document scoring phase executes.
5. Result corruption / error induction: The victim's documents are scored against the attacker's query, producing incorrect scores. Alternatively, if the attacker's request consumes the shared use counter first, the victim's request raises a ValueError: late-interaction query cache miss error (Github Advisory, vllm PR #51445).

• Network: Concurrent HTTP POST requests to /score or /rerank endpoints from different source IPs or clients sharing identical X-Request-Id header values; unusual volume of concurrent requests to scoring endpoints.
• Logs: vLLM access logs showing multiple simultaneous requests with the same X-Request-Id value; ValueError: late-interaction query cache miss for key ... errors appearing in vLLM server logs for requests that should have valid cached queries.
• Application Behavior: Anomalous or unexpected scoring results returned to clients (e.g., scores dramatically different from expected values); increased rate of cache-miss errors on /score or /rerank endpoints without a corresponding increase in legitimate traffic.

The primary remediation is to upgrade vLLM to version 0.30.0 or later, which resolves the issue by generating a server-side random_uuid() namespace for each scoring request's cache key instead of using the caller-supplied X-Request-Id header (vllm Release v0.30.0, vllm Commit ee17d0d). As interim workarounds for deployments that cannot immediately upgrade: restrict access to the /score and /rerank endpoints to trusted callers only; implement API gateway-level controls that strip or randomize the X-Request-Id header before forwarding requests to vLLM; and monitor for suspicious patterns of concurrent requests with identical request identifiers (Github Advisory).

The vulnerability was discovered and reported by the "Patch the Planet" collaboration between Trail of Bits and OpenAI, and was notably identified using GPT-5.5-Cyber as part of the Patch the Planet security initiative — highlighting the emerging role of AI-assisted vulnerability research (Github Advisory, vllm Security Advisory). The fix was contributed by Clinton Thomas (@KernelClint) and Lucas Bourtoule (@dhalf) and merged promptly by the vLLM maintainers. No significant broader media coverage or social media controversy has been observed, consistent with the moderate severity rating.