7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24779

CVE-2026-24779: vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods obtain and process media from URLs provided by users, using different Python parsing libraries when restricting the target host. These two parsing libraries have different interpretations of backslashes, which allows the host name restriction to be bypassed. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources. This vulnerability is particularly critical in containerized environments like llm-d, where a compromised vLLM pod could be used to scan the internal network, interact with other pods, and potentially cause denial of service or access sensitive data. For example, an attacker could make the vLLM pod send malicious requests to an internal llm-d management endpoint, leading to system instability by falsely reporting metrics like the KV cache state. Version 0.14.1 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24779

CVE-2026-24779:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	< 0.14.1	0.14.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) within the vLLM library, specifically in the MediaConnector class responsible for handling multimodal inputs. The root cause is a discrepancy in how URLs are parsed between the validation logic and the request execution logic. The code used urllib.parse.urlparse to validate the domain of a user-provided URL, but the requests library (which uses urllib3.util.parse_url internally) was used to make the actual request. These two parsers handle certain characters, like backslashes, differently. This inconsistency allows an attacker to craft a URL that passes the urlparse-based validation but is interpreted by requests/urllib3 as a request to an internal or restricted resource.

The provided patch f46d576c54fb8aeec5fc70560e850bed38ef17d7 rectifies this by standardizing on urllib3.util.parse_url across the codebase, ensuring that the URL is interpreted consistently during both validation and execution. The analysis of this patch clearly points to MediaConnector.load_from_url and its asynchronous counterpart MediaConnector.load_from_url_async as the vulnerable entry points, as they are the functions that accept and process the malicious URL. The _assert_url_in_allowed_media_domains function is also included as it contains the flawed security check that is bypassed.

Vulnerable functions

MediaConnector.load_from_url

vllm/multimodal/utils.py

This function is a primary entry point for the SSRF vulnerability. It accepts a URL from a user, uses the `urlparse` function for validation which has parsing inconsistencies with the underlying request library, and then proceeds to fetch content from the URL. This discrepancy allows an attacker to bypass the hostname validation and force the server to make requests to internal network resources.

MediaConnector.load_from_url_async

vllm/multimodal/utils.py

This is the asynchronous version of `load_from_url` and is vulnerable in the exact same way. It uses `urlparse` for validation, which can be bypassed due to parsing differences with the HTTP client, leading to a Server-Side Request Forgery vulnerability.

MediaConnector._assert_url_in_allowed_media_domains

vllm/multimodal/utils.py

This function is responsible for checking if the requested URL's hostname is in the allowed domains list. The vulnerability is triggered because this function operates on a parsed URL object from `urlparse` which can misinterpret the hostname of a maliciously crafted URL. This allows an attacker's request to an unauthorized internal domain to pass this check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.