vLLM CVE-2026-73560

Exploitation requires authenticated API access to vLLM at the low-privilege level (confirmed by PR:L in the CVSS vector), meaning the attacker must possess a valid API key or equivalent credential to submit inference requests to the target vLLM instance. The vulnerable code path is only reachable when the vLLM server is configured to serve a MiMo V2 Omni model that instantiates MiMoV2OmniMultiModalProcessor - deployments using other model families or processor implementations are not affected by this specific bypass. The attacker must supply image or audio inputs as URL strings (http://, https://, file://) or bare filesystem paths rather than pre-decoded binary or tensor data; base64 data URIs (data:image) are also accepted by the vulnerable code. Exploitation impact is bounded by the vLLM process's OS-level file permissions and network reachability: a sandboxed deployment with restricted filesystem access and egress filtering materially reduces blast radius. No special network positioning, administrator-level access, specific operating system, or non-default runtime flags beyond MiMo V2 Omni model serving are required.

The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 Medium, correctly reflecting low-complexity network exploitability requiring only low-privilege API access, with high confidentiality impact and no integrity or availability consequences. The PR:L requirement confirms that vLLM API credentials constitute the authentication barrier, limiting direct exposure to authorized but not necessarily trusted users. No public exploit code has been identified and this CVE is not listed in CISA KEV, meaning active exploitation is unconfirmed at time of analysis; EPSS data was not included in the provided intelligence sources. Despite the Medium score, the practical risk is elevated in environments where vLLM is exposed to semi-trusted or third-party API consumers: the vLLM process frequently runs with broad filesystem access to model weights, configuration files, and secrets, and the SSRF vector can reach cloud metadata services (169.254.169.254) or internal APIs with the vLLM host's network identity - even a mid-sized AI infrastructure team in mielec running vLLM behind a VPN for internal users should treat this as urgent if the MiMo V2 Omni processor is in use. The S:U scope designation is a modest understatement of real-world risk, as SSRF pivot to adjacent internal systems represents impact beyond the vulnerable system itself that the base vector does not capture.

An authenticated vLLM API user submits a multimodal inference request targeting a MiMo V2 Omni model, embedding a crafted image URL pointing to an internal cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ or a file:// path referencing sensitive files like environment variable files or service account keys accessible to the vLLM process. The MiMoV2OmniMultiModalProcessor calls _fetch_image or requests.get on the attacker-supplied string without consulting MediaConnector's allowlists, retrieves the target resource on behalf of the vLLM server, and the fetched content is processed as image or audio data - potentially surfacing portions of the retrieved content in error messages or inference outputs. No public proof-of-concept exploit code has been identified, but exploitation requires only a standard API call with a crafted multimodal input string.