TL;DR: What We Found
Impact: Complete server compromise without authentication. Affects vLLM 0.8.3 - 0.14.0 with multimodal video support. Patch available in 0.14.1+.
The Attack Chain: 2-Stage Exploitation
The vulnerability exploits a heap overflow in OpenCV's JPEG2000 decoder, combined with an information leak that bypasses ASLR. Together, they provide reliable RCE.
Vulnerable Models (Video-Capable)
Global Exposure: 175,000+ Servers
Geographic Distribution
Exposure Statistics
Active Attack Campaign (GreyNoise Data)
88% acceleration: Most attacks occurred in just 11 days, indicating active exploitation campaigns.
Our Stealth Reconnaissance
We conducted stealth reconnaissance through Tor to identify exposed vLLM endpoints. All scanning was passive - no exploitation attempts were made.
| Provider | Status | Models | Multimodal | Risk |
|---|---|---|---|---|
| DeepInfra | OPEN | 132 | 6 | Medium |
| OpenRouter | OPEN | Router | N/A | Low |
| Together AI | AUTH | Unknown | Yes | Low |
All scans routed through Tor (exit: 205.185.113.8). No exploitation attempts. Detection and documentation only.
LLMjacking: The Business Impact
Compromised vLLM servers are monetized through "LLMjacking" - unauthorized use of AI infrastructure for spam, disinformation, crypto mining, or API resale.
GPU resources used for unauthorized inference or crypto mining
Access to models, training data, and conversation history
Stolen access sold on criminal marketplaces (silver.inc)
Pivot to other systems in the network
Active criminal marketplace (silver.inc) selling access to compromised LLM endpoints. Documented by Trend Micro and Pillar Security.
Immediate Mitigation Steps
pip install --upgrade vllm>=0.14.1
# Use text-only models if video not needed # Remove: llava, qwen-vl, phi-vision, etc.
vllm serve model_name --api-key YOUR_SECRET_KEY
iptables -A INPUT -p tcp --dport 8000 -s TRUSTED_IP -j ACCEPT iptables -A INPUT -p tcp --dport 8000 -j DROP
# nginx.conf
location /v1/ {
auth_basic "vLLM API";
proxy_pass http://localhost:8000;
}Disclosure Timeline
Running vLLM in Production?
Get a professional security assessment to identify vulnerabilities before attackers do. We specialize in AI infrastructure security.
This research was conducted for defensive purposes only. All testing was stealth reconnaissance. No user data was accessed or stored.