In the disaggregated multimodal pipeline described by the vendor, rendering produces feature tensors and metadata for generation. The vulnerable generation endpoint accepts caller-supplied serialized feature state as though it were trusted renderer output. An authenticated client with access to the affected API can therefore cross an internal…
Inspect the ClaimsCase · DiggingBeagle record
vLLM scale-out multimodal generation trusts forged render state
An authenticated client of the disaggregated scale-out API can supply feature fields which the generate path treats as trusted renderer output, permitting engine failure and integrity impact according to the vendor advisory. Distinct from request-mask and EXIF cache issues.
Scope
Specific disaggregated multimodal deployment shape
Assessment profile
Assessment method- Exploitation
- not established
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is unknown; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-VLLM-FORGED-FEATURES-01 · CLM-2026-VLLM-FORGED-FEATURES-02 · vLLM advisory GHSA-ph72-cqr5-qpp7: untrusted scale-out features
At a glance
Only relevant to the configured disaggregated transport; no confirmed real-world exploitation, shell execution or victim exposure.
Limits and uncertaintyFull account
In the disaggregated multimodal pipeline described by the vendor, rendering produces feature tensors and metadata for generation. The vulnerable generation endpoint accepts caller-supplied serialized feature state as though it were trusted renderer output. An authenticated client with access to the affected API can therefore cross an internal rendering-to-generation trust boundary, with integrity or availability consequences described in the advisory.
The advisory states versions below 0.30.0 are affected and 0.30.0 contains the patch. This is not the EXIF/LoRA cache-key alias issue and the pinned material does not establish exploitation in the wild, arbitrary shell execution or universal exposure of all vLLM installations. The disaggregated deployment shape and access prerequisites materially limit the claim.
Claims & evidence
CLM-2026-VLLM-FORGED-FEATURES-01The advisory states POST /inference/v1/generate trusts caller-supplied serialized encoder tensors and multimodal metadata without sufficient binding to a trusted render result.supported
Basis: reported finding
- supportsvLLM advisory GHSA-ph72-cqr5-qpp7: untrusted scale-out featuresprimary disclosure
Summary: render and generate routes
CLM-2026-VLLM-FORGED-FEATURES-02The advisory lists affected versions below 0.30.0 and a patch in 0.30.0.supported
Basis: reported finding
- supportsvLLM advisory GHSA-ph72-cqr5-qpp7: untrusted scale-out featuresprimary disclosure
Package: affected and patched versions
Unknowns and contradictions
- Only relevant to the configured disaggregated transport; no confirmed real-world exploitation, shell execution or victim exposure.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153