Vulnerability in Vllm-Project Vllm
CVE-2026-114049
vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so recycled batch slots apply their token allowlist to victims' unrestricted requests.
Published .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/vllm-project/vllm/security/advisories/GHSA-6cxc-2vcg-w5qc (vendor-advisory)
- www.vulncheck.com/advisories/vllm-before-0.31.0-stale-allowed-token-ids-mask-vi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-114049?
- CVE-2026-114049 is a low-severity vulnerability in Vllm-Project Vllm, classified under Expected Behavior Violation. CVSS score: 3.7/10. Published 2026-10-21.
- How severe is CVE-2026-114049?
- Low severity. CVSS v3 base score is 3.7 out of 10.