CVE-2026-116176: vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

Q: Which deployments are exposed to this issue?

vLLM versions from 0.9.2 up to, but not including, 0.24.0 are affected. Exposure requires an API caller to be able to send requests with a crafted X-Request-Id header.

Q: What does an attacker need to exploit it?

The attacker needs network-level access to the vLLM API and does not need privileges or user interaction. They can embed a decode address in X-Request-Id to cause a P2pNcclConnector prefill worker to initiate a ZMQ connection to an attacker-controlled host.

Q: What could an attacker obtain or disrupt?

A successful attack may leak the NCCL unique_id and KV-cache tensors to the attacker-controlled host. It can also block the affected worker.

Published Oct 25, 2026

Updated

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL uniqueid and KV-cache tensors or blocking the worker.

Affected Software

1 affected component

vllm vllm>=0.9.2<0.24.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

vLLM versions from 0.9.2 up to, but not including, 0.24.0 are affected. Exposure requires an API caller to be able to send requests with a crafted X-Request-Id header.

What does an attacker need to exploit it?

The attacker needs network-level access to the vLLM API and does not need privileges or user interaction. They can embed a decode address in X-Request-Id to cause a P2pNcclConnector prefill worker to initiate a ZMQ connection to an attacker-controlled host.

What could an attacker obtain or disrupt?

A successful attack may leak the NCCL unique_id and KV-cache tensors to the attacker-controlled host. It can also block the affected worker.

CVE-2026-116176: vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What could an attacker obtain or disrupt?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What could an attacker obtain or disrupt?