CVE-2026-116176 in vLLM
Summary
by MITRE • 10/25/2026
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified within vLLM versions prior to 0.24.0 represents a critical server-side request forgery flaw that exploits improper validation of input headers during API interactions. Specifically, the defect resides in how the system processes the X-Request-Id header when initiating distributed inference operations. By embedding a maliciously crafted decode address within this header, an attacker can manipulate internal networking components to establish unauthorized outbound connections. This issue is particularly severe because it targets the P2pNcclConnector prefill worker, which relies on ZeroMQ for inter-process communication in multi-GPU or multi-node setups. The flaw allows external actors to redirect these internal connection attempts toward hosts controlled by the attacker rather than legitimate cluster nodes.
From a technical perspective, this vulnerability enables an adversary to force the ZMQ-connect function within the prefill worker to establish a link with an arbitrary remote host. This manipulation facilitates two primary attack vectors: data exfiltration and service disruption. In the context of data leakage, the compromised connection can be used to intercept sensitive internal state information. The attacker gains access to the NCCL unique_id, which is crucial for coordinating collective communications in distributed deep learning frameworks, as well as KV-cache tensors. These tensors contain intermediate representations of processed text or prompts and may include proprietary model weights or confidential user data depending on the application context. Alternatively, if exfiltration is not the goal, an attacker can exploit this connection to block the worker process. By maintaining a persistent malicious connection or sending malformed packets through the forced link, the adversary can cause resource exhaustion or deadlock conditions that effectively deny service to legitimate inference requests.
The operational impact of this vulnerability extends beyond simple data loss. In production environments where vLLM is deployed for high-throughput language model serving, such an attack can degrade system reliability and compromise intellectual property. The leakage of NCCL unique_ids allows attackers to potentially hijack or disrupt distributed training jobs that rely on these identifiers for synchronization. Furthermore, the exposure of KV-cache tensors poses a significant privacy risk, as it may reveal sensitive information embedded in user prompts or proprietary model behaviors. Service disruption attacks can lead to cascading failures across the inference cluster, impacting availability and increasing operational costs due to manual intervention required to restart affected workers.
This vulnerability aligns with CWE-918, Server-Side Request Forgery (SSRF), as it involves manipulating server-side logic to make requests on behalf of the application to unintended destinations. Additionally, from a threat intelligence perspective, this behavior maps to MITRE ATT&CK technique T1071, Application Layer Protocol, specifically within the context of protocol manipulation and lateral movement via internal service exploitation. The ability to force outbound connections also touches upon aspects of data exfiltration over alternative channels, similar to techniques observed in advanced persistent threat campaigns that abuse legitimate services for covert communication.
Mitigation strategies should prioritize immediate patching to version 0.24.0 or later where this input validation issue has been addressed. In environments where upgrading is not immediately feasible, network-level controls such as strict egress filtering can help mitigate the risk by blocking unauthorized outbound connections from worker processes. Implementing robust input sanitization for all HTTP headers, particularly those used in internal routing logic like X-Request-Id, is essential to prevent similar exploitation vectors. Additionally, deploying zero-trust principles within the inference cluster architecture ensures that even if an attacker gains initial access through API endpoints, they cannot easily establish trusted connections with arbitrary external hosts without proper authentication and authorization checks at the network layer.