CVE-2026-24779: vLLM Server-Side Request Forgery (SSRF) Vulnerability in MediaConnector
Summary
CVE-2026-24779: vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector. Affects vllm versions < 0.14.1. Fixed in 0.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source project designed for multimodal machine learning, enabling users to load and process various media types such as images, audio, and video. The project features a MediaConnector class that facilitates the fetching of media content from user-provided URLs. However, due to a vulnerability in its URL handling, vLLM is susceptible to Server-Side Request Forgery (SSRF) attacks, which can lead to unauthorized access to internal network resources.
Vulnerability Detail
The SSRF vulnerability in vLLM arises from the MediaConnector class's load_from_url and load_from_url_async methods. These methods utilize different URL parsing libraries that interpret backslashes differently, allowing attackers to bypass hostname restrictions. This flaw can enable an attacker to coerce the vLLM server into making arbitrary requests to internal resources, potentially leading to data exposure or denial of service. The vulnerability is particularly critical in containerized environments, where a compromised vLLM pod could scan the internal network and interact with other pods, causing instability and false reporting of metrics.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.1
This is the first release that contains the fix.
pip install --upgrade "vllm==0.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the URLs that can be processed by the MediaConnector class by implementing additional validation checks before passing user-provided URLs to the load_from_url method. This can help mitigate the risk of SSRF attacks until the package is updated.
Conclusion
The vLLM package is vulnerable to a Server-Side Request Forgery (SSRF) due to improper URL handling in its MediaConnector class. It is crucial for users to update to version 0.14.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vllm →
FAQ
The vulnerability is a Server-Side Request Forgery (SSRF) that allows attackers to make unauthorized requests to internal network resources.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, denial of service, and instability in containerized environments.
Yes, the vulnerability has been patched in version 0.14.1 of the vLLM package. It is recommended to update to this version.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
