Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M
CVE-2026-54232vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile
High 8.8
In plain English
A high-severity uncontrolled search path in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | vllm | 0.22.1 | PYSEC-2026-227 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vllm-project | vllm | < 0.22.1 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-jrf6-vqxq-pjv2 x_refsource_CONFIRM