CVE-2026-73555

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-73555

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73555.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-73555

Aliases

Downstream

CGA (5)

MINI (3)

Published

2026-08-13T14:50:03Z

Modified

2026-10-21T02:30:41Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Details

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-209"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73555.json"
}

References

Affected packages

Git / github.com/vllm-project/vllm

Affected ranges

Type

GIT

Repo

https://github.com/vllm-project/vllm

Events

Introduced

Fixed

ffd46bfab2128bb84146050e98b51a617c6575ab

Fixed

e87521626febe2763f997691d1599de4175f4324

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.26.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "e87521626febe2763f997691d1599de4175f4324"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v0.26.0",
            "range":  [
                {
                    "fixed":  "ffd46bfab2128bb84146050e98b51a617c6575ab"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other

submission

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.10.0

v0.10.0rc1

v0.10.0rc2

v0.10.1rc1

v0.10.2rc1

v0.10.2rc2

v0.11.0rc1

v0.11.1

v0.11.1rc0

v0.11.1rc1

v0.11.1rc2

v0.11.1rc3

v0.11.1rc4

v0.11.1rc5

v0.11.1rc6

v0.13.0rc1

v0.14.0rc0

v0.14.0rc1

v0.15.0rc1

v0.15.2rc0

v0.16.0rc0

v0.16.0rc1

v0.17.0rc0

v0.17.1rc0

v0.17.2rc0

v0.18.0rc0

v0.18.1rc0

v0.18.2rc0

v0.19.1rc0

v0.19.2rc0

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.20.1rc0

v0.20.2rc0

v0.21.1rc0

v0.22.1rc0

v0.23.1rc0

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.4.0.post1

v0.4.1

v0.4.2

v0.4.3

v0.5.0

v0.5.0.post1

v0.5.1

v0.5.2

v0.5.3

v0.5.3.post1

v0.5.4

v0.5.5

v0.6.0

v0.6.1

v0.6.1.post1

v0.6.1.post2

v0.6.2

v0.6.3

v0.6.3.post1

v0.6.4

v0.6.4.post1

v0.6.5

v0.6.6

v0.6.6.post1

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.8.0rc1

v0.8.0rc2

v0.8.1

v0.8.2

v0.8.3rc1

v0.8.4

v0.9.0

v0.9.1

v0.9.1rc1

v0.9.1rc2

v0.9.2rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73555.json"