From 8bd7737a03bfcd4a1bca008f9f0e94729f8d67dc Mon Sep 17 00:00:00 2001 From: Sunny Rangnani <1923481+SunnyR@users.noreply.github.com> Date: Tue, 6 Oct 2026 08:39:59 -0600 Subject: [PATCH] [Docs] Clarify that vLLM does not isolate tenants sharing a server (#59811) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: SunnyR Co-authored-by: Claude Co-authored-by: Juan Pérez de Algaba <124347725+jperezdealgaba@users.noreply.github.com> --- docs/usage/security.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/docs/usage/security.md b/docs/usage/security.md index d350b6bdfd..3dad19d6cb 100644 --- a/docs/usage/security.md +++ b/docs/usage/security.md @@ -550,6 +550,15 @@ ensure that only trusted principals can submit work to the cluster: - Place the Ray cluster on an isolated network segment. - Do not expose the Ray client port or dashboard to untrusted networks. +## Multi-Tenant Deployments + +vLLM does not provide isolation between tenants that share the same server process. Requests from different callers are scheduled together and share the same caches. Options such as `cache_salt` reduce specific cross-tenant risks, but they are not an isolation boundary. + +If tenants must be isolated from each other, enforce it in the deployment architecture: + +- Run a dedicated vLLM instance per tenant. +- Place a gateway in front of vLLM that authenticates callers and scopes client-supplied cache identifiers, such as `cache_salt` and multimodal `uuid` values, per tenant. + ## Prefix Cache Timing Side-Channel Mitigation (Cache Salting) ### Background @@ -633,7 +642,7 @@ For additional cross-tenant isolation, set `cache_salt` on each request (see [Pr - **Multi-tenant deployments**: Always generate cryptographically random UUIDs per media item. Additionally, set `cache_salt` to a per-tenant secret for defense in depth. - **Single-tenant deployments**: Ensure UUIDs are unique per distinct media content. `cache_salt` is unnecessary when there is no cross-tenant threat. -- **Default behavior**: Omitting `uuid` entirely preserves the default content-hash-based identity, which is safe against this class of collision but requires hashing the media bytes on every request. +- **Default behavior**: Omitting `uuid` uses a hash of the media bytes as the cache identity, which requires hashing the media on every request. This avoids accidental collisions between callers, but it does not isolate tenants from each other. See [Multi-Tenant Deployments](#multi-tenant-deployments). ## Reporting Security Vulnerabilities