CVE-2026-105752

A low severity flaw was found in vLLM, the LLM inference and serving engine shipped in Red Hat AI Inference Server 3 and Red Hat OpenShift AI (RHOAI). When a multi-turn request submitted through the /v1/responses endpoint uses a tool continuation, vLLM rebuilds the next-turn engine input without preserving the cache_salt value, so the continuation prefix is cached in the shared, unsalted namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct another tenant's low-entropy post-tool history can submit the same continuation and use the per-turn cached-token counts reported in the response usage to determine whether that prefix was previously processed, defeating the tenant isolation that salted prefix caching is intended to provide. The resulting cross-tenant information disclosure is limited to confirming whether specific prompts or inputs were previously processed by another user; prompt content is not directly disclosed. Exploitation requires several specific preconditions, including an operator-enabled tool server, a victim request that sets cache_salt and triggers a tool continuation, and sufficiently accurate reconstruction of the victim's post-tool history. Both the Red Hat and upstream assessments rate this flaw Low severity (CVSS 3.1 score 3.1, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Because this flaw is rated Low impact, the fix for the affected Red Hat AI Inference Server 3 and Red Hat OpenShift AI releases is deferred, as Red Hat does not file trackers for Low severity flaws; the residual risk is that an authenticated user of a multi-tenant deployment with prefix caching enabled could infer whether specific inputs of another tenant were processed.