CVE-2026-73555: Information disclosure vulnerability in vLLM request validation handling

# CVE-2026-73555: Information disclosure vulnerability in vLLM request validation handling

https://gcdradar.vercel.app/incidents/cve-2026-73555-information-disclosure-vulnerability-in-vllm · AIR-2026-0076 · closed 2026-08-13

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-08-13
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-73555
- CVSS: 5.3

## Summary

Improper error message sanitization in vLLM prior to version 0.26.0 allows unauthenticated malformed requests to leak internal server paths, Python versions, and package structures. The vulnerability exposes system metadata through error traces.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-09-04: CVE-2026-73555: vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages (https://github.com/advisories/GHSA-hwrm-c4cx-rf4j)
- 2026-08-13: CVE-2026-73555: vLLM is an inference and serving engine for large language models. (https://nvd.nist.gov/vuln/detail/CVE-2026-73555)

## Sources

- 2026-08-13 NVD: CVE-2026-73555: vLLM is an inference and serving engine for large language models. https://nvd.nist.gov/vuln/detail/CVE-2026-73555
- 2026-09-04 GitHub Advisory Database: CVE-2026-73555: vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages https://github.com/advisories/GHSA-hwrm-c4cx-rf4j

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.