vLLM cache_salt dropped in Harmony tool continuations

vLLM versions ≤0.25.1 silently drop the cache_salt parameter during Harmony tool-continuation re-submissions, causing continuation prefixes to be cached in the unsalted namespace. This restores a cross-tenant prefix-cache membership oracle that allows attackers to infer other tenants' prompt membership.

Disclosed 6 October 2026 · Record updated 6 October 2026

Impact

Cross-tenant information disclosure: a second tenant can guess post-tool history and read exact cached-token counts, restoring the prompt-membership oracle that cache_salt was designed to prevent.

Our coverage

A locksmith's salt crystals scatter across a shared hallway floor after a guest uses the master key, leaving fresh footprints visible to the next tenant arriving.

Vulnerabilities

vLLM drops cache salt in tool turns, leaking prompt hints

An advisory published on 6 October 2026 says vLLM silently discards a caller's cache_salt after tool calls, re-opening a cross-tenant prefix-cache oracle.

6 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-935w-9g4m-p28p
github.comhttps://github.com/advisories/GHSA-ph3r-5jfg-f84f