https://vulnerability.circl.lu/sightings/feed 2026-10-06T21:30:52.574920+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/462c39da-ebf4-42d8-a188-876f0f3ffb83/export 2026-10-06T21:30:52.596302+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "462c39da-ebf4-42d8-a188-876f0f3ffb83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105752", "type": "seen", "source": "https://gist.github.com/alon710/fc11ccb569b6f106fb32d9147f53be46", "content": "# CVE-2026-105752: CVE-2026-105752: Cross-Tenant Prefix-Cache Information Leak via Cache Salt Omission in vLLM Harmony Path\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105752\n\n## Summary\nA vulnerability in vLLM prior to 0.30.0 allows an authenticated multi-tenant attacker to infer execution history and prompt structures of other tenants. The multi-turn Responses API ('Harmony' path) fails to propagate the 'cache_salt' parameter during tool-call continuation steps, storing sensitive prompt prefixes in the global, unsalted cache space.\n\n## TL;DR\nvLLM fails to propagate the cache partition salt during multi-turn tool execution continuations, exposing post-tool prompt prefixes in the shared global cache and creating a side-channel oracle for co-tenants.\n\n## Technical Details\n\n- **CWE ID**: CWE-524, CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.1 (Low)\n- **EPSS Score**: 0.00043\n- **Impact**: Partial Tenant Cache Isolation Failure / Metadata Leakage\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- vLLM engine deployments utilizing the multi-turn Responses API ('Harmony' path) with prefix caching enabled.\n- **vLLM**: < 0.30.0 (Fixed in: `0.30.0`)\n\n## Mitigation\n\n- Upgrade the vLLM deployment to version 0.30.0 or newer.\n- Disable global prefix caching via the startup configuration flag.\n- Limit exposure by restricting multi-tenant access to multi-turn agent endpoints.\n\n**Remediation Steps:**\n1. Identify all active vLLM container instances running versions prior to 0.30.0.\n2. In corporate environments where immediate upgrading is blocked, modify the container startup arguments to include --enable-prefix-caching=false to disable the caching side-channel.\n3. Update requirements.txt, pyproject.toml, or Dockerfiles to specify vllm>=0.30.0.\n4. Deploy the updated service images to the staging environment and verify that multi-turn API calls successfully output responses without errors.\n5. Perform rolling updates of the production instances to complete the remediation process.\n\n## References\n\n- [GitHub Security Advisory: GHSA-935w-9g4m-p28p](https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p)\n- [NVD - CVE-2026-105752 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-105752)\n- [CVE.org Authority Record for CVE-2026-105752](https://www.cve.org/CVERecord?id=CVE-2026-105752)\n- [vLLM v0.30.0 Release Tag](https://github.com/vllm-project/vllm/releases/tag/v0.30.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105752) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T03:30:34.000000Z"} 2026-10-06T03:30:34+00:00 https://vulnerability.circl.lu/sighting/89ecfc6c-4f91-47da-ac12-b42bfc39192d/export 2026-10-06T21:30:52.598769+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "89ecfc6c-4f91-47da-ac12-b42bfc39192d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105752", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-935w-9g4m-p28p", "content": "", "creation_timestamp": "2026-10-06T00:02:02.000000Z"} 2026-10-06T00:02:02+00:00