Input Validation Flaw in vLLM Serving Engine Affects User Data Security
CVE-2026-73555

5.3MEDIUM

Key Information:

Vendor

Vllm-project

Status
Vllm
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73555?

The vLLM inference and serving engine for large language models contains an input validation flaw prior to version 0.26.0. This vulnerability stems from the improper handling of FastAPI RequestValidationError objects, which can inadvertently expose sensitive data. Specifically, unauthenticated users may send malformed JSON requests to various endpoints, leading to the leakage of the operating system username, home and virtual environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This flaw could potentially allow attackers to gain insights into the application's structure and user environment, raising significant security concerns. Users are advised to upgrade to version 0.26.0, where this issue has been resolved.

Affected Version(s)

vllm < 0.26.0

References

https://github.com/vllm-project/vllm/security/advisories/...
x_refsource_CONFIRM
https://github.com/vllm-project/vllm/pull/46415
x_refsource_MISC
https://github.com/vllm-project/vllm/commit/e87521626febe...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.