CVE-2026-54232: vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UVINDEXSTRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.22.1 - Configuration
Remove the global UV_INDEX_STRATEGY='unsafe-best-match' setting from the Dockerfile or build environment so pip/installer does not use the unsafe-best-match index selection strategy.
vLLM Dockerfile / build environment UV_INDEX_STRATEGY = remove/unset 'unsafe-best-match' - Configuration
Do not install packages from a custom index via --extra-index-url for package names that are not registered on PyPI; remove or restrict use of --extra-index-url (flashinfer.ai/whl/) in the Dockerfile and ensure packages are obtained from trusted, verified sources.
vLLM Dockerfile --extra-index-url = do not use --extra-index-url for unregistered package names (flashinfer.ai/whl/) - Compensating control
Denylist or block installation of the PyPI package/version flashinfer-jit-cache==0.6.11.post2 in your build systems and internal package caches to prevent the malicious package from being pulled during builds.
- Operational
Assume images built with the vulnerable Dockerfile may be backdoored: rebuild all affected container images after applying fixes and reconfiguration, and rotate any API credentials, secrets, and model/data access tokens that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54232?
The severity of CVE-2026-54232 is high with a CVSS score of 8.8.
How do I fix CVE-2026-54232?
To fix CVE-2026-54232, upgrade to vLLM version 0.22.1 or later.
What type of vulnerability is CVE-2026-54232?
CVE-2026-54232 is a dependency confusion vulnerability found in the vLLM Dockerfile.
What impact does CVE-2026-54232 have on my application?
CVE-2026-54232 can allow attackers to execute arbitrary code by exploiting the dependency confusion through the flashinfer-jit-cache package.
Who is affected by CVE-2026-54232?
Any users of vLLM versions prior to 0.22.1 are affected by CVE-2026-54232.