Executive brief
vLLM is a high-throughput engine for serving Large Language Models (LLMs). In specific multi-node configurations using the older V0 engine, a security flaw allows an attacker to execute malicious code on the servers. This could lead to a full takeover of the AI infrastructure, potentially exposing sensitive model data or disrupting AI-powered services.
Technical details
A remote code execution (RCE) vulnerability exists in vLLM's V0 engine when deployed in a multi-node configuration using tensor parallelism. The vulnerability stems from the use of the Python 'pickle' module to deserialize data received over ZeroMQ 'SUB' sockets on secondary hosts. An attacker who has compromised the primary host, or one who can perform network-level attacks like ARP poisoning, can send a malicious pickle payload to trigger arbitrary code execution on secondary nodes. This issue affects versions 0.5.2 through 0.9.x; it was addressed in version 0.10.0 by the transition to the V1 engine, which is not affected.
Affected products
- vLLM Project vLLM >= 0.5.2, < 0.10.0
Timeline
- 2025-05-06: disclosed
- 2025-05-06: advisory
- 2025-05-06: patched: Fixed in version 0.10.0