AIDEFEND in Action AIA-0115 Validated Research Published: Oct 26, 2026

vLLM Harmony: A Tool Continuation Drops the Tenant Cache Boundary

vLLM serves language models and reuses prompt-prefix computation to improve performance. In the affected GPT-OSS Harmony Responses tool loop, the first turn carried cache_salt but the tool continuation did not. Another tenant could submit a guessed continuation and inspect exact cached-token counts to test whether it had been processed. CVE-2026-105752 is an inference-cache membership leak, not arbitrary transcript extraction; the advisory lists 0.30.0 as fixed.

Privacy LeakageAI Deployment SecurityMulti-Tenant AIAI Infrastructure
4 applicable AIDEFEND defenses
Source: Harmony tool continuations drop cache_salt, restoring a cross-tenant prefix-cache membership oracle 
Author: @jperezdealgaba
Original article: Sep 28, 2026

Threat Analysis

  • Follow the continuation: the victim's first request is salted, then a tool result causes vLLM to rebuild the next inference input without that salt. The prefix enters the global unsalted namespace even though the caller requested isolation.
  • Understand the observable signal: another tenant must guess the continuation and inspect cached_tokens_per_turn. This confirms membership of a guessed low-entropy history, not a general ability to download unknown conversations.
  • Repair inside the serving path: tenant binding must survive all internal turns, worker transitions and reuse decisions. A correct gateway request or an earlier cache vulnerability's fix does not establish that this separate continuation is protected.

Applicable AIDEFEND Defenses (4)

AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
Very High
Deploy vLLM 0.30.0 or a later supported fixed build to every affected worker and verify the loaded engine version. Reproduce the Harmony built-in/MCP tool continuation with two synthetic tenants, not only a single-turn request. Verify every continuation carries the intended isolation and that an attacker request does not observe the victim-warmed prefix. Until that passes, disable the affected shared prefix-cache path or isolate serving; a gateway adding cache_salt to turn one cannot repair the internal drop.
AID-H-027
Inference Cache Integrity, Partitioning & Safe Reuse
High
Derive an opaque cache partition from authenticated tenant/security context and bind the serving-engine reuse salt to it on every lookup and internal re-submission. This requires an engine release or integration that preserves the value through Harmony tool continuations. Exercise a second tenant against the exact cached_tokens_per_turn signal as well as reuse behavior; if the hook is absent or drops the salt, disable sharing or request isolated placement instead of treating the gateway salt as protection.
AID-H-032.002
Cross-Tenant Serving-State Isolation
High
When safe cross-tenant reuse cannot be demonstrated, have the serving operator disable shared prefix/KV reuse or give each tenant a separate engine and cache population. Enforce the same separation on worker replacement, scaling and failover, with effective runtime readback. This changes the shared-serving topology; it does not earn a second cache-key-integrity result for the salt check owned by AID-H-027. API consumers need provider evidence or an actually isolated service tier.
AID-H-032.003
Inference Telemetry & Debug Surface Restriction
High
The serving-platform developer can keep exact per-turn cache-hit counters out of ordinary tenant responses and expose them only through a separately authorized operations telemetry path. Enforce the projection on every Responses/streaming/diagnostic route and verify actual returned bytes. This removes the demonstrated cached_tokens_per_turn oracle independently of the cache repair; residual timing signals still require cache isolation. A standard usage field must be handled explicitly, not assumed covered by a debug toggle or ordinary API login.

What Defenders Should Do Now

  • Update affected vLLM workers to the supported fixed release and test actual Harmony tool continuations with synthetic tenants.
  • Derive cache partitions from authenticated server-side identity. Verify the salt at every engine re-submission and reject unsupported isolation rather than trusting a request flag.
  • Disable shared prefix/KV reuse or use isolated engine/cache populations until the cross-tenant test passes, including restart and failover. Inspect the exact cached-token response signal.
  • Remove exact per-turn cache-hit counters from ordinary responses and keep detailed telemetry on a separately authorized path. Test actual JSON and streaming output; timing leakage still needs isolation.

Conclusion

AIDEFEND  maps this failure to verified remediation, engine-enforced cache partitions and serving-state isolation. The security property has to hold after the tool result as well as before it; a salt that disappears during an internal turn cannot protect another tenant's cached content.

Last updated: