CVE-2026-54232: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack…

PriorityP354high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.30%

22.0th percentile

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
rhaii	vllm-cuda-rhel9	—	—
rhaiis	vllm-cuda-rhel9	—	—
rhelai3	bootc-aws-cuda-rhel9	—	—
rhelai3	bootc-azure-cuda-rhel9	—	—
rhelai3	bootc-cuda-rhel9	—	—
rhelai3	bootc-gcp-cuda-rhel9	—	—
vllm-project	vllm	< 0.22.1	0.22.1
vllm	vllm	< 0.22.1	0.22.1

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vendor_redhat8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.