PYSEC-2026-4351: vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL uniqueid and KV-cache tensors or blocking the worker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.24.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any API caller that can send requests to the affected vLLM service can exploit it; no authentication, user interaction, or special access is indicated by the supplied vector. Exposure is therefore most significant where the API is reachable by untrusted clients.
What does an attacker need to include in a request?
The attacker embeds a decode address in the X-Request-Id header. This can cause a P2pNcclConnector prefill worker to initiate a ZMQ connection to an attacker-controlled host.
What is the potential impact of a successful exploit?
The outbound connection can leak the NCCL unique_id and KV-cache tensors to the attacker. It can also block the affected worker, causing an availability impact.
Which versions are affected?
vLLM versions from 0.9.2 up to, but not including, 0.24.0 are affected. Upgrading to 0.24.0 or later removes the affected version range.