CVE-2026-105752 vllm-project CVE debrief

Who should care

Defenders responsible for the security of systems using the vLLM package should be aware of this vulnerability and take steps to mitigate it. This includes verifying the version of vLLM in use and upgrading to version 0.30.0 or later.

Why it matters

The vLLM package vulnerability allows for a cross-tenant prefix-cache membership oracle attack due to the dropping of the `cache_salt` in tool continuations. Defenders should prioritize verifying the version of vLLM in use and upgrading to version 0.30.0 or later to mitigate this vulnerability.

• A second tenant may be able to guess the low-entropy post-tool history and submit the reconstructed continuation to read exact per-turn cached-token counts from the Responses usage
• The vulnerability allows for a cross-tenant prefix-cache membership oracle attack
• Defenders need to verify the version of vLLM in use and upgrade to version 0.30.0 or later to mitigate this vulnerability

Technical summary

The vLLM package is vulnerable to a cross-tenant prefix-cache membership oracle attack due to the dropping of the `cache_salt` in tool continuations. This occurs on the GPT-OSS 'Harmony' path when a request uses a built-in or MCP tool and runs as a multi-turn loop. The continuation prefix is cached in the global unsalted namespace, allowing a second tenant to guess the low-entropy post-tool history and submit the reconstructed continuation to read exact per-turn cached-token counts from the Responses usage.

Defensive priority

Defenders should prioritize verifying the version of vLLM in use and upgrading to version 0.30.0 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify the version of vLLM in use
• Upgrade to version 0.30.0 or later
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the silent dropping of the `cache_salt` in tool continuations, allowing a second tenant to guess the low-entropy post-tool history and submit the reconstructed continuation to read exact per-turn cached-token counts from the Responses usage.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.