The advisory describes two independent ways caller-influenced metadata could be mistaken for the identity of cached state. In one, an EXIF ImageID can override image-content hashing, making different image bytes appear to share a multimodal cache entry. In the other, a string supplied as a prefix-cache salt can collide with an untagged LoRA-name string for…
Inspect the ClaimsCase · DiggingBeagle record
vLLM cross-request cache identity confusion via EXIF and LoRA salt
Two independent cache paths described in one advisory can collide when attacker-influenced values are used without adequate content binding or domain tagging. Exploitation requires the affected configuration and request controls.
Scope
Authenticated client-controlled cache metadata in affected vLLM deployments
Assessment profile
Assessment method- Exploitation
- not established
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is unknown; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-VLLM-CACHE-KEY-ALIASES-01 · CLM-2026-VLLM-CACHE-KEY-ALIASES-02 · CLM-2026-VLLM-CACHE-KEY-ALIASES-03 · vLLM advisory GHSA-rh6f-3x46-j33q: caller-controlled cache identities
At a glance
Neither site is documented as code execution or whole-prompt exfiltration; exact earlier affected version bound has not been established.
Limits and uncertaintyFull account
The advisory describes two independent ways caller-influenced metadata could be mistaken for the identity of cached state. In one, an EXIF ImageID can override image-content hashing, making different image bytes appear to share a multimodal cache entry. In the other, a string supplied as a prefix-cache salt can collide with an untagged LoRA-name string for an initial KV block. Each path crosses a distinct trust boundary and should be evaluated against its own required configuration.
The vendor lists versions below 0.31.0 as affected and 0.31.0 or later as patched. The mechanism is cache-state confusion across requests, not documented remote shell execution or proven wholesale extraction of another user's prompts. The earlier vLLM request-slot restriction leak and the separate forged-render-features advisory share an isolation theme but are different defects.
Claims & evidence
CLM-2026-VLLM-CACHE-KEY-ALIASES-01The advisory says a UUID-valued image EXIF ImageID can supersede content hashing so different images map to the same multimodal processor-cache entry.supported
Basis: reported finding
- supportsvLLM advisory GHSA-rh6f-3x46-j33q: caller-controlled cache identitiesprimary disclosure
Summary: Site A EXIF ImageID
CLM-2026-VLLM-CACHE-KEY-ALIASES-02The advisory says a first-block prefix-cache key can collide when a caller-controlled cache_salt string equals a static LoRA name, allowing first-block KV-state confusion across requests.supported
Basis: reported finding
- supportsvLLM advisory GHSA-rh6f-3x46-j33q: caller-controlled cache identitiesprimary disclosure
Summary: Site B untyped prefix-cache extra keys
CLM-2026-VLLM-CACHE-KEY-ALIASES-03The advisory lists affected versions below 0.31.0 and patched versions 0.31.0 or later for the described issue family.supported
Basis: reported finding
- supportsvLLM advisory GHSA-rh6f-3x46-j33q: caller-controlled cache identitiesprimary disclosure
Package, Affected versions, Patched versions
Unknowns and contradictions
- Neither site is documented as code execution or whole-prompt exfiltration; exact earlier affected version bound has not been established.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153