CVE-2026-54232·Docker vulnerability
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.
- Severity
- high
- Software
- Docker
- Fixed in
- 0.22.1
- Published
- 2026-06-22
Affected versions
Until: 0.22.1
Fixed in: 0.22.1
How to fix this CVE
Update Docker to the latest version that includes the patched vLLM component (0.22.1 or later). This vulnerability stems from a dependency confusion attack targeting the vLLM inference engine's build process, where an attacker could inject malicious code during container image creation. Immediately rebuild all Docker images created with vulnerable vLLM versions to prevent backdoored containers from running in production.
sudo dnf update docker-ceDefensia detects this vulnerability
How to check if you are affected
- Check Docker version: docker --version
- List all Docker images and their creation timestamps: docker images --no-trunc --format '{{.Repository}}:{{.Tag}} {{.CreatedAt}}'
- For each image, inspect vLLM version in the Dockerfile history: docker history <image-id> | grep -i vllm
- Verify the vLLM version inside running containers: docker exec <container-id> pip show vllm | grep Version
- Check container build logs for flashinfer-jit-cache package installation: docker inspect <image-id> | grep -A 20 'flashinfer'
Indicators of compromise
- PyPI package: flashinfer-jit-cache version 0.6.11.post2
- Docker image layer containing vLLM version < 0.22.1
- Dockerfile RUN command with 'flashinfer.ai/whl/' index URL
FAQ
What is CVE-2026-54232?
CVE-2026-54232 is a dependency confusion vulnerability in vLLM's Docker build process where an attacker can register a malicious package on PyPI with the same name as a private dependency, allowing arbitrary code execution as root during container image creation and potential backdooring of production deployments.
Is CVE-2026-54232 being actively exploited?
According to CISA's Known Exploited Vulnerabilities list, CVE-2026-54232 is not currently being actively exploited in the wild, and no public exploits are available. However, the attack vector is straightforward and organizations should prioritize remediation.
What versions of Docker are affected by CVE-2026-54232?
Docker installations running vLLM versions prior to 0.22.1 are affected. Any container image built with vulnerable vLLM code remains at risk until rebuilt with the patched version.
How do I check if my server is vulnerable to CVE-2026-54232?
Run 'docker images' to list all images, then for each image execute 'docker inspect <image-id>' and search for vLLM version in the layers. If vLLM version is below 0.22.1, the image is vulnerable.
Does Defensia detect CVE-2026-54232?
Yes — Defensia's CVE advisory scanner compares installed Docker package versions and detects vLLM versions within container images against the NVD database. If vulnerable images are present on a monitored server, CVE-2026-54232 will appear in your dashboard with remediation steps.
Related Docker CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-54232. Free for 1 server.
Get started free