vLLM up to 0.14.0 MediaConnector server-side request forgery

Summaryinfo

A vulnerability described as critical has been identified in vLLM up to 0.14.0. This issue affects the function MediaConnector. Executing a manipulation can lead to server-side request forgery. This vulnerability appears as CVE-2026-24779. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in vLLM up to 0.14.0 and classified as critical. This vulnerability affects the function MediaConnector. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods obtain and process media from URLs provided by users, using different Python parsing libraries when restricting the target host. These two parsing libraries have different interpretations of backslashes, which allows the host name restriction to be bypassed. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources. This vulnerability is particularly critical in containerized environments like `llm-d`, where a compromised vLLM pod could be used to scan the internal network, interact with other pods, and potentially cause denial of service or access sensitive data. For example, an attacker could make the vLLM pod send malicious requests to an internal `llm-d` management endpoint, leading to system instability by falsely reporting metrics like the KV cache state. Version 0.14.1 contains a patch for the issue.

The advisory is available at github.com. This vulnerability was named CVE-2026-24779 since 01/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 0.14.1 eliminates this vulnerability. Applying the patch f46d576c54fb8aeec5fc70560e850bed38ef17d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-4711) and CERT Bund (WID-SEC-2026-0233). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source vllm

Productinfo

Name

• vLLM

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion