vLLM: forged public multimodal SHM handles can reach worker-side pickle.loads() when insecure serialization is disabled
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
vLLM released security advisory GHSA-6757-hggm-hp2w (CVE-2026-115912): when --mm-processor-cache-type shm is enabled, versions before 0.32.0 allow an authenticated caller to forge multimodal SHM handles through public scale-out requests, causing the worker side to execute pickle.loads() on bytes pre-placed by the attacker in the ring buffer, ultimately executing arbitrary Python code in the worker process. This chain is reachable through ordinary public HTTP routes and does not require enabling VLLM_ALLOW_INSECURE_SERIALIZATION=1; the verified exploit uses the /v1/chat/completions/render, /v1/chat/completions and /inference/v1/generate interfaces in sequence, and causes the EngineCore health check to drop from 200 to 503.
Even without insecure serialization enabled, an authenticated caller can forge SHM handles to execute arbitrary code in the vLLM worker process; deployers can use this to check for affected versions.