vLLM Remote Code Execution via PyNcclPipe Deserialization Vulnerability
vLLM versions 0.6.5 to 0.8.4 contain a remote code execution vulnerability in the PyNcclPipe communication service where unsafe deserialization of pickle objects allows attackers to execute arbitrary code. The vulnerability was patched in version 0.8.5 by restricting the TCPStore to listen only on specified private network interfaces.
What happened
vLLM versions 0.6.5 through 0.8.4 contain a remote code execution vulnerability in the PyNcclPipe class, which is used for peer-to-peer communication and GPU KV-Cache transmission between distributed nodes. The vulnerability exists because PyNcclPipe directly deserializes untrusted data using pickle.loads without validation.
The PyNcclPipe service was documented to listen only on private networks specified by the --kv-ip CLI parameter, but PyTorch's TCPStore interface defaults to listening on all interfaces (0.0.0.0) regardless of the IP provided. An attacker can craft malicious serialized Python objects and send them to the exposed service to execute arbitrary code.
Reported impact
The vulnerability only affects environments using the PyNcclPipe KV cache transfer integration with the V0 engine. An attacker with network access to the service can gain server control privileges by sending malicious serialized data.
Index analysis
The root cause is unsafe deserialization using pickle.loads on client-provided data without proper input validation. The secondary issue is that PyTorch's TCPStore binds to all network interfaces by default, contrary to the documented security model.
Governance controls
vLLM was patched in version 0.8.5 to implement a workaround that forces the TCPStore instance to bind its socket to the specified private interface. This addresses the gap between documented behavior and actual default behavior from PyTorch.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.