One routing header bypassed the policy guard: vLLM Semantic Router's Istio bug dissected
colinmcnamara · x · 2026-11-13
Colin McNamara dissects a policy bypass he found in vLLM Semantic Router's Istio integration: because two filters shared the same name, a single routing header let requests skip the policy guard entirely, returning 200 with no logs. Finding the bug took a day, the fix (a rename) an hour, but coordinated disclosure and reaching other projects running the same pattern took two weeks; the advisory went public six days after his report. The post also covers his Austin AIMUG talk and a fact-check of the so-called "Black October" security incidents. He warns anyone running Istio 1.27+ with an InferencePool route and third-party extproc filters to check their setup.
Related event: Policy Bypass Flaw Found in vLLM Semantic Router's Istio Integration(2 posts)→
More from Infra
- llama.cpp gotcha: -ngl -1 means auto, not all — switching fixed CPU usage and 60→76 t/s — randomjapaneselearn · 2026-11-13
- MoE expert offloading on a 16GB RX 9070XT: three engines benchmarked, ExLlamaV3 leads — willeyh · 2026-11-13
- Google expands TPU v8 lineup with 8tx and 8i Max optimized chips — Beth_Kindig · 2026-11-13
- Microsoft data center outage sparks jokes about servers 'going on protest' — SuB8u · 2026-11-13
- Data centers need power – lower income, rural residents pay the price — PaulHoule · 2026-11-13
- Notion indexes 10B+ docs on turbopuffer, cuts search costs 80% — DevinLewtan · 2026-11-13