EUVD-2026-60377Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible API requires low-privilege credentials (PR:L); allowlist bypass enables arbitrary file read and SSRF but confers no write or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.
AnalysisAI
Server-side request forgery in vLLM's MiMoV2OmniMultiModalProcessor allows authenticated API users to bypass the framework's media access controls, enabling arbitrary file reads on the vLLM host and SSRF requests to internal network resources. The flaw affects all vLLM releases prior to 0.26.0 where attacker-controlled image and audio URL strings were passed directly to _fetch_image, requests.get, and Image.open instead of routing through the MediaConnector abstraction that enforces allowed_media_domains and allowed_local_media_path restrictions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated API access to vLLM at the low-privilege level (confirmed by PR:L in the CVSS vector), meaning the attacker must possess a valid API key or equivalent credential to submit inference requests to the target vLLM instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 Medium, correctly reflecting low-complexity network exploitability requiring only low-privilege API access, with high confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated vLLM API user submits a multimodal inference request targeting a MiMo V2 Omni model, embedding a crafted image URL pointing to an internal cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ or a file:// path referencing sensitive files like environment variable files or service account keys accessible to the vLLM process. The MiMoV2OmniMultiModalProcessor calls _fetch_image or requests.get on the attacker-supplied string without consulting MediaConnector's allowlists, retrieves the target resource on behalf of the vLLM server, and the fetched content is processed as image or audio data - potentially surfacing portions of the retrieved content in error messages or inference outputs. … |
| Remediation | Upgrade vLLM to version 0.26.0 or later, which removes the vulnerable _fetch_image function and eliminates all direct requests.get and Image.open calls on user-controlled strings within MiMoV2OmniMultiModalProcessor; the specific fix commit is 54503ecec0f3ac31e5ecfc5f28652e4cc42307b5 and the release is at https://github.com/vllm-project/vllm/releases/tag/v0.26.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Denial of service in vllm 0.19.0's OpenAI-compatible serving path allows remote unauthenticated attackers to exhaust sch
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 9.0)
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today