vLLM forged shared-memory multimodal metadata across scale-out workers (cross-worker cache poisoning)

vLLM's multimodal features.kwargs_data is client-controlled and carries shared-memory addresses/monotonic IDs that workers later trust. An authenticated caller can forge these to alias or poison another request's cached multimodal content in scale-out shared-memory deployments. CVSS 7.5.

In multi-tenant vLLM serving, this lets one tenant corrupt or read another tenant's cached multimodal data, breaking isolation and enabling cross-request data leakage or injection into a different request's context.

An authenticated caller sets forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments where multimodal caching uses shared memory, worker processes trust these values without validating they were produced by the request owner, allowing cache aliasing or poisoning across requests.

vLLM prior to 0.32.0 (scale-out / disaggregated multimodal serving).

Upgrade to vLLM 0.32.0 or later (fix in commit 3d5625cc). Restrict multimodal shared-memory caching or disable it in multi-tenant deployments until patched.