SGLang accepts caller-supplied image hash as cache identity in native inference requests

A multimodal inference cache is only safe when its identity represents the actual content and the tenant's allowed reuse scope. SGLang issue 44641 describes the native /generate endpoint accepting client-supplied mm_hashes rather than independently recomputing hashes for image content in affected versions. After one image has entered the cache, a second request can supply a different image and the earlier cached hash, causing the server to produce responses based on the previous image-derived context.

The researcher reports an observed response mismatch in a controlled configuration and discusses a patch that computes content hashes by default, with an explicit opt-in trust setting for callers. The issue also reports a two-host test: a second client supplied a different image with the first client's declared hash and received text reflecting the earlier cached image marker. That is an observed cross-client contamination in the controlled setup, not merely a hypothetical consequence. It does not establish arbitrary reading of every tenant's cache, a particular production victim or attacker knowledge of all cached hashes. Cache-hit prerequisites and endpoint selection matter; the report distinguishes the native API route from the OpenAI-compatible route.

Unlike an injection that changes an instruction, this concerns server-side evidence identity and content reuse. A fast cache response is not proof that it was derived from the current user's input.