Vulnerability Overview

Disclosed in late May 2026, CVE-2026-22778 is a critical security vulnerability affecting vLLM, a popular open-source LLM inference library widely deployed in production cloud AI infrastructures.

The flaw allows remote, unauthenticated attackers to execute arbitrary system commands on the host container by sending a specially crafted multimodal video request to the vLLM API server. With a CVSS score of 9.8, this vulnerability represents a severe threat to AI deployments, exposing API tokens, model weights, and cloud environment secrets.

Technical Details

The issue stems from the multimodal input pipeline, specifically how vLLM handles video frame extraction. vLLM uses an internal wrapper surrounding FFmpeg and OpenCV to decode incoming video frames before passing them to the visual language models (VLMs).

When a request is submitted to the /v1/chat/completions endpoint containing a video object, the backend library parses the request parameters and constructs an internal system call to extract frames. Due to insufficient validation of video metadata filenames and option keys, an attacker can inject command separator characters (like ; or &) into metadata parameters. When the command executes, the injected commands run with the permissions of the vLLM server process.

Mitigation & Remediation

Organizations serving multimodal inference models via vLLM must upgrade immediately.

1. Upgrade vLLM

Upgrade to vLLM v0.4.3 or higher, which introduces robust input validation and switches from shell-based execution to secure Python binding abstractions (like PyAV) for video frame parsing.

# Update python package
pip install --upgrade vllm

2. Sandbox Container Access

Strictly restrict the privileges of running vLLM containers:

• Ensure containers run as non-root users (user: "1000:1000" in Docker Compose).
• Employ read-only root filesystems and limit GPU directory bindings to read-only where possible.
• Enforce Network Policies to restrict outbound traffic from LLM containers.