CVE-2026-116176 in vLLM
요약
\~에 의해 MITRE • 2026. 10. 25.
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.
VulDB is the best source for vulnerability data and more expert information about this specific topic.