{
 "id": "AIR-2026-0076",
 "slug": "cve-2026-73555-information-disclosure-vulnerability-in-vllm",
 "title": "CVE-2026-73555: Information disclosure vulnerability in vLLM request validation handling",
 "summary": "Improper error message sanitization in vLLM prior to version 0.26.0 allows unauthenticated malformed requests to leak internal server paths, Python versions, and package structures. The vulnerability exposes system metadata through error traces.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "data_leak"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-08-13",
 "incident_date_precision": "day",
 "first_reported": "2026-08-13",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73555",
   "publisher": "NVD",
   "title": "CVE-2026-73555: vLLM is an inference and serving engine for large language models.",
   "published_at": "2026-08-13"
  },
  {
   "url": "https://github.com/advisories/GHSA-hwrm-c4cx-rf4j",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-73555: vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages",
   "published_at": "2026-09-04"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-73555",
  "vllm",
  "information-disclosure"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}