Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-13 | 1 | Active Exploitation1 |
| 2026-09-05 | 1 | Disclosure1 |
🟠 vLLM, Information Disclosure via Error Messages, #CVE-2026-73555 (Medium) -DC-Sep2026-2208 https://dailycve.com/vllm-information-disclosure-via-error-messages-cve-2026-73555-medium-dc-sep2026-2208/
Post summary
A disclosure article announces CVE-2026-73555 affecting vLLM, detailing an information disclosure via error messages with no evidence of exploitation or mitigation.
⚠️ HIGH — CVE-2026-73555 vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in… CVSS 5.3 ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-73555 #OpenAI #CyberSecurity #InfoSec
Post summary
CVE‑2026‑73555 is reported as actively exploited in the wild; while no PoC or exploit code is linked, the post provides technical context such as a CVSS score of 5.3 and affected component details.