Vllm
CVE-2026-25960
CRITICAL
GHSA-v359-jj2v-j536
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv7 – Jun 30, 2026
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server into fetching attacker-chosen internal URLs, bypassing the allowed_media_domains allowlist that was added to fix CVE-2026-24779. The bypass exploits a backslash-before-@ parsing disagreement between urllib3.util.parse_url (validation layer) and aiohttp/yarl (HTTP client), so a URL the allowlist reads as a permitted host is actually fetched from an internal target. It carries a CVSS 9.8 rating, a vendor patch and Red Hat advisory are available, and a working bypass payload is published in the GHSA advisory and fix test suite, though EPSS is very low (0.02%, 3rd percentile) and it is not on CISA KEV.
Earlier versions of this analysis (6)
Server-Side Request Forgery in vLLM 0.17.0 allows remote attackers to bypass the SSRF protection introduced for CVE-2026-24779 (added in 0.15.1) and coerce the server into making requests to arbitrary internal or external hosts. The flaw stems from a URL parser-differential: the validation layer extracts the hostname with urllib3.util.parse_url() while load_from_url_async actually fetches via aiohttp/yarl, so a crafted URL passes validation but resolves to a different host at request time. No public exploit was identified at time of analysis, and the EPSS score is very low (0.02%), but the CVSS base score of 9.8 and the parser-confusion nature make it a high-value bypass for environments exposing the affected endpoint.
Server-Side Request Forgery in vLLM's multimodal MediaConnector lets remote attackers bypass the allowed_media_domains allowlist by exploiting backslash-parsing disagreement between urllib3 (validation) and aiohttp/yarl (the actual HTTP client), defeating the SSRF hardening shipped for CVE-2026-24779. Any vLLM deployment serving multimodal models that fetches user-supplied media URLs is affected, allowing the server to be coerced into requesting arbitrary internal network resources. CVSS is 9.8 and a vendor/Red Hat patch exists, but EPSS is only 0.02% and there is no public exploit identified at time of analysis beyond the bypass payloads embedded in the fix's own test suite.
Server-side request forgery in vLLM 0.17.0 lets remote attackers bypass the SSRF protection introduced for CVE-2026-24779 (added in 0.15.1) by abusing a URL-parser differential: the validation layer uses urllib3.util.parse_url() to extract and check the hostname, while load_from_url_async fetches via aiohttp/yarl, which parse the same URL differently. A crafted URL that passes validation but resolves to a different host in aiohttp coerces the server into making attacker-controlled internal requests. No public exploit identified at time of analysis; EPSS is very low (0.02%, 3rd percentile), and a vendor patch plus Red Hat errata are available.
Server-Side Request Forgery in vLLM 0.17.0 allows remote unauthenticated attackers to bypass the SSRF protection introduced for CVE-2026-24779 by exploiting a URL-parser mismatch in the load_from_url_async method. Because the validation layer relies on urllib3's parse_url() while the actual fetch uses aiohttp/yarl, a crafted URL can pass hostname validation yet resolve to a different internal host, letting an attacker coerce the server into making requests to internal services. No public exploit has been identified at time of analysis and EPSS is low (0.02%), but the CVSS 9.8 rating and confirmed parser-differential root cause make this a credible internal-pivot risk.
Server-Side Request Forgery in vLLM's multimodal MediaConnector lets remote users coerce the inference server into fetching attacker-chosen internal URLs, bypassing the allowed_media_domains allowlist. The flaw is a regression: the SSRF control added for CVE-2026-24779 validates the hostname with urllib3's parse_url() but the async fetch path (load_from_url_async) issues the request through aiohttp/yarl, which parses a backslash before '@' differently - urllib3 reads the host as the allowed domain while yarl routes the request to the attacker's host. It carries a 9.8 CVSS but EPSS is only 0.02% (3rd percentile); a vendor patch and a confirmed PoC test case exist, though no public exploitation is reported.
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. [CVSS 7.1 HIGH]
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated SSRF reaching backend systems justifies AV:N/AC:L/PR:N and S:C with C:H for internal data exposure; integrity is only low and availability impact is not demonstrated.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
10DescriptionNVD
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.
Blast Radius
ecosystem impact- 1 pypi packages depend on vllm (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.15.1.
Executive ViewAI
vLLM deployments using multimodal processing are vulnerable to a critical control bypass (CVE-2026-25960, CVSS 9.8) that allows attackers to force inference servers into accessing internal infrastructure, creating direct risks of data breach, service disruption, and lateral movement. Publicly available exploit code exists, amplifying urgency for organizations relying on vLLM for inference workloads. Vendor patches are available and must be deployed immediately.
Within 24 hours: Identify all vLLM deployments with multimodal MediaConnector enabled; assess exposure to untrusted user input and external network accessibility. Within 7 days: Deploy vendor-released patch (available per Red Hat and vLLM security advisories) to all affected systems; conduct security testing to confirm the bypass is closed. Within 30 days: Implement SSRF pattern detection in network monitoring systems; conduct comprehensive policy review of allowed_media_domains configurations across all vLLM infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Affected Products (CPE)NVD
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB