CVE-2026-24779
📋 TL;DR
A Server-Side Request Forgery (SSRF) vulnerability in vLLM's MediaConnector class allows attackers to bypass host restrictions and make the server send requests to internal network resources. This affects vLLM versions before 0.14.1 with multimodal features enabled. The vulnerability is particularly dangerous in containerized environments where it could enable internal network scanning and interaction with other services.
💻 Affected Systems
- vLLM
📦 What is this software?
Vllm by Vllm
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full access to internal network resources, compromises other pods/services, exfiltrates sensitive data, and causes denial of service through malicious requests to management endpoints.
Likely Case
Internal network reconnaissance, unauthorized access to internal services, potential data exposure from other pods, and system instability through false metric reporting.
If Mitigated
Limited to unsuccessful SSRF attempts if proper network segmentation and input validation are in place.
🎯 Exploit Status
Exploitation requires sending specially crafted URLs with backslashes to bypass host restrictions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.14.1
Vendor Advisory: https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc
Restart Required: Yes
Instructions:
1. Update vLLM to version 0.14.1 or later using pip: pip install --upgrade vllm>=0.14.1
2. Restart all vLLM services
3. Verify the patch is applied by checking the version
🔧 Temporary Workarounds
Disable MediaConnector functionality
allDisable the vulnerable MediaConnector feature if not required
Configure vLLM to not use multimodal features or MediaConnector
Network segmentation
allRestrict vLLM pod network access to only required services
Apply network policies to limit vLLM pod egress traffic
🧯 If You Can't Patch
- Implement strict input validation and URL sanitization for MediaConnector inputs
- Deploy network-level controls to restrict vLLM pod access to internal resources
🔍 How to Verify
Check if Vulnerable:
Check if vLLM version is below 0.14.1 and multimodal features are enabledCheck Version:
python -c "import vllm; print(vllm.__version__)"Verify Fix Applied:
Confirm vLLM version is 0.14.1 or higher and test MediaConnector with malicious URLs containing backslashes📡 Detection & Monitoring
Log Indicators:
- Unusual URL patterns with backslashes in MediaConnector requests
- Requests to internal IP addresses from vLLM pods
- Failed SSRF attempts in application logs
Network Indicators:
- vLLM pods making unexpected outbound connections to internal services
- Traffic to non-whitelisted internal endpoints
SIEM Query:
source="vllm" AND (url="*\\*" OR dest_ip=10.* OR dest_ip=192.168.* OR dest_ip=172.16.*)