{"data":{"id":"7b97b299-f7ba-4f2b-8174-2a5d7f2287f1","title":"CVE-2026-105752: vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations…","summary":"vLLM versions prior to 0.30.0 drop the cache_salt value when rebuilding the next-turn engine input for Harmony tool continuations submitted through POST /v1/responses. The continuation prefix lands in the global unsalted cache namespace even when the caller enabled salting, and on deployments with prefix caching enabled (the default), an authenticated tenant can use the cached_tokens_per_turn count to determine whether a victim's low-entropy post-tool prefix was previously processed, defeating salted prefix cache isolation.","solution":"Fixed in version 0.30.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105752","publishedAt":"2026-10-05T23:17:01.710Z","cveId":"CVE-2026-105752","cweIds":["CWE-200","CWE-524"],"cvssScore":"3.1","cvssSeverity":"low","severity":"low","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":["vllm@< 0.30.0 (fixed: 0.30.0)"],"affectedPackageNames":["vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM prefix cache isolation bypass in Harmony tool continuations","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00216,"epssCheckedAt":"2026-10-10T06:42:00.270Z","kevDateAdded":null,"advisoryAliases":["GHSA-935w-9g4m-p28p"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:42:50.869Z","patchAvailable":true,"disclosureDate":"2026-10-05T23:17:01.710Z","capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}