Description

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T15:20:17.773Z",
  "pubdate": "2026-08-13T15:20:17.773Z",
  "executiveSummary": "An information disclosure vulnerability exists in the vLLM inference and serving engine prior to version 0.26.0.\nThe vulnerability arises from improper error handling and message sanitization within FastAPI request validation workflows, leading to the leakage of sensitive internal system metadata.\nUnauthenticated threat actors can exploit this vulnerability by submitting malformed JSON requests to targeted application endpoints, including /v1/chat/completions, /v1/completions, /tokenize, and /detokenize.\nSuccessful exploitation allows attackers to harvest critical reconnaissance data such as underlying operating system usernames, home directories, virtual environment paths, Python runtime versions, internal package structures, source code line numbers, and specific endpoint handler names.\nThis leaked intelligence significantly lowers the barrier for subsequent, more targeted attacks against the deployment infrastructure.\nRisk implications include compromised system confidentiality and accelerated reconnaissance phases for malicious actors.\nRemediation requires upgrading the vLLM product to version 0.26.0 or later, where the underlying validation exception handling and message sanitization mechanisms have been securely patched.",
  "technicalDetails": "The root cause of the vulnerability resides in how vLLM handles FastAPI RequestValidationError objects and sanitizes error payloads prior to returning them to the client.\nSpecifically, within vllm/entrypoints/openai/server_utils.py, the validation_exception_handler improperly converts validation exceptions using string casting via str(exc).\nConcurrently, the sanitize_message function located in vllm/entrypoints/utils.py fails to adequately strip traceback-style file paths and internal exception details from the generated error messages.\nThe vulnerable components include the request validation handlers and error sanitization utilities exposed across multiple public-facing API routes, specifically /v1/chat/completions, /v1/completions, /tokenize, and /detokenize.\nThe affected product is vLLM across all versions prior to 0.26.0.\nExploitation requires zero authentication and no special privileges, as the vulnerable endpoints are publicly exposed as part of the standard inference and serving interface.\nThe attack flow proceeds as follows: an unauthenticated attacker transmits a deliberately malformed JSON payload to one of the targeted API endpoints over the network.\nUpon receiving the payload, the FastAPI application attempts to validate the incoming request structure, triggering a RequestValidationError.\nThe unpatched validation_exception_handler catches this exception and processes it using unsafe string conversion.\nThe internal sanitize_message routine then fails to filter out sensitive debugging artifacts, traceback file paths, and runtime metadata from the exception response.\nFinally, the application returns an HTTP response containing the verbose error message directly to the attacker.\nPost-exploitation impact is focused on information disclosure, yielding highly granular environmental intelligence including OS usernames, absolute home and virtual environment paths, exact Python versions, internal file layouts, code line numbers, and handler identifiers, which facilitates targeted follow-up exploits."
}