{"schema":"threatline.record/2","record":{"id":"GHSA-6cxc-2vcg-w5qc","aliases":["GHSA-6cxc-2vcg-w5qc"],"summary":"V1 InputBatch.condense leaves a stale allowed_token_ids mask on recycled batch rows","details":"## Severity\r\n\r\n- **Severity:** Low\r\n- **CVSS v3.1:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N` (3.7, Low)\r\n- **CWE:** CWE-440 (Expected Behavior Violation), CWE-668 (Exposure of Resource to Wrong Sphere)\r\n\r\n## Summary\r\n\r\nvLLM V1 `InputBatch.condense()` can leave a stale `allowed_token_ids_mask_cpu_tensor` row after moving a constrained request. A later unrestricted request that reuses that batch slot inherits the previous request's token allowlist, so sampling for that other client is constrained by a mask it did not set (cross-request output-integrity issue). The victim request still returns HTTP 200 with no error indication.\r\n\r\nPublic report: https://github.com/vllm-project/vllm/issues/43894\r\n\r\n## Affected\r\n\r\n- **Ecosystem / package:** pip / `vllm`\r\n- **Affected versions:** vLLM ≤ 0.30.0 (V1 worker `InputBatch` path). Confirmed via public issue #43894.\r\n- **Fixed versions:** Fix merged in https://github.com/vllm-project/vllm/pull/43931 (not yet in a tagged release as of v0.30.0; expected in the next release).\r\n\r\n## Details\r\n\r\n`InputBatch.condense()` copies `allowed_token_ids_mask_cpu_tensor` from a moved request's row into the freed index but never clears the source row. `add_request()` only writes that row when the new request sets `sampling_params.allowed_token_ids`. When another active request still has `allowed_token_ids`, `_make_sampling_metadata()` copies the active prefix of the CPU mask to GPU and `Sampler.apply_logits_processors()` applies the stale whitelist to the unrestricted request.\r\n\r\nAn attacker who can submit generate traffic (including unauthenticated `/invocations`, which is outside `--api-key` guards, or any valid API key on `/v1`) plants a chosen `allowed_token_ids` mask. If batching/`condense` recycles that row onto another client's unrestricted request while the constrained request is still active, the victim's tokens are limited to the attacker's allowlist (for example only a single token, only digit tokens, or only tokens that spell a short phrase). This is vocabulary steering / wrong allowlist application, not free-form substitution of arbitrary attacker text.\r\n\r\nA related but distinct bug in `InputBatch.swap_states()` (row-view aliasing of the same mask tensor) was fixed in https://github.com/vllm-project/vllm/pull/48419.\r\n\r\n## Impact\r\n\r\nLimited cross-request sampling integrity on a shared engine: one client's `allowed_token_ids` can constrain another client's outputs under concurrent batching. Confidentiality and availability are unaffected. Attack complexity is High because exploitation needs concurrent requests plus a `condense` slot-reuse race while the attacker's constrained request remains in the batch.\r\n\r\n## Patches\r\n\r\n- https://github.com/vllm-project/vllm/pull/43931 — clear vacated `allowed_token_ids` mask rows in `condense()`\r\n- https://github.com/vllm-project/vllm/pull/48419 — related `swap_states` mask aliasing fix\r\n\r\n## References\r\n\r\n- https://github.com/vllm-project/vllm/issues/43894\r\n- https://github.com/vllm-project/vllm/pull/43931\r\n- https://github.com/vllm-project/vllm/pull/48419\r\n- https://docs.vllm.ai/en/latest/usage/security.html (API key does not cover `/invocations`)\r\n\r\n## Credit\r\n\r\nReported publicly by @glaziermag in issue #43894.\r\n","categories":["Unclassified"],"product":"vllm","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-6cxc-2vcg-w5qc","source_modified_at":"2026-10-06T20:45:08Z","fetched_at":"2026-10-25T05:59:55.871881Z","package":{"ecosystem":"pip","name":"vllm"},"range":"< 0.31.0"}],"fixed_versions":[],"cvss":3.7,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T20:45:08Z","modified_at":"2026-10-06T20:45:08Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-6cxc-2vcg-w5qc","fetched_at":"2026-10-25T05:59:55.871881Z","source_modified_at":"2026-10-06T20:45:08Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T20:45:08Z","content_hash":"8788525aeb17040d9f0e5a8a1f0fa47dff1399f9a60f3bd4ff6a5cb1163b4d15"}}