Executive brief
vLLM is an open-source LLM serving framework that provides an API for running large language models. When the API receives malformed requests, error messages inadvertently expose sensitive system information including the OS username, home directory path, Python version, and internal file paths. An unauthenticated attacker can trigger these errors with a single malformed HTTP request to any JSON-accepting endpoint, enabling reconnaissance and precise version fingerprinting to facilitate targeted exploits.
Technical details
The vulnerability is an information disclosure flaw (CWE-209) in vLLM's error handling. When FastAPI raises a Pydantic RequestValidationError for malformed JSON or missing required fields, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts the exception to a string via str(exc), which includes internal file paths and line numbers. The existing sanitize_message() function strips memory addresses but does not filter File "...", line X patterns. This allows unauthenticated attackers to extract OS username, home directory path, virtual environment location, Python version, internal package structure, and handler function names—all prerequisites for targeted exploitation. The vulnerability affects all POST endpoints accepting JSON bodies including /v1/chat/completions, /v1/completions, /tokenize, and /detokenize. No authentication or user interaction is required. The fix (patched in version 0.26.0) involves either reconstructing error messages from structured Pydantic error lists rather than raw exception strings, or adding regex-based filtering to strip file path patterns.
Affected products
- vLLM Project vLLM < 0.26.0
Timeline
- 2026-07-27: disclosed
- 2026-09-04: advisory
- 2026-09-04: patched: Fix released in vLLM v0.26.0