Remote Code Execution via Unsafe Deserialization in vLLM V0 Multi-Node Clusters
A remote code execution vulnerability was disclosed in vLLM's V0 engine affecting multi-node distributed deployments. The flaw uses unsafe pickle deserialization on ZeroMQ sockets to execute arbitrary code. The vLLM Project decided not to provide a patch and instead recommends users maintain network-level security controls.
What happened
In vLLM V0 engine deployments using multi-node tensor parallelism, secondary hosts connect to a primary host via ZeroMQ SUB/XPUB sockets for distributed communication. Data received on these SUB sockets is deserialized using Python's pickle module without validation, allowing arbitrary code execution.
Reported impact
If the primary vLLM host is compromised, this vulnerability could be leveraged to compromise secondary hosts in the cluster. Attackers could alternatively exploit the vulnerability by using ARP cache poisoning to redirect traffic to a malicious endpoint that delivers arbitrary code payloads to target machines.
Index analysis
The vulnerability affects vLLM versions 0.5.2 and later, but only the V0 engine, which has been off by default since v0.8.0. The vLLM Project stated that V0 is not expected to be commonly deployed in multi-node configurations and noted the fix would be invasive, so no fix was provided. The V1 engine is not affected by this issue. The vulnerability is classified as High severity with a CVSS v3 base score of 8.0.
Governance controls
The vLLM Project recommends that users ensure their environment is on a secure network if using the V0 engine with multi-node tensor parallelism.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.