CVE-2026-25960: vLLM SSRF Protection Bypass Vulnerability
Summary
CVE-2026-25960: vLLM has SSRF Protection Bypass. Affects vllm versions >= 0.15.1, < 0.17.0. Fixed in 0.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient and scalable machine learning model serving. It allows users to load models from various sources, including URLs. However, due to a flaw in its URL parsing mechanism, the library is susceptible to Server-Side Request Forgery (SSRF) attacks, which can lead to unauthorized access to internal or external services.
Vulnerability Detail
The vulnerability arises from a bypass in the SSRF protection implemented in the load_from_url_async method of vLLM. The inconsistency between the URL parsing behavior of urllib3 and aiohttp allows attackers to manipulate URLs to access unauthorized resources. Specifically, the validation layer uses urllib3 to parse URLs, which treats backslashes differently than aiohttp, leading to potential SSRF attacks. An attacker can provide a malicious URL that passes validation but ultimately redirects requests to an unintended host, compromising the security of the application.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.17.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using URLs that contain backslashes or ensure that your application has additional validation checks in place to prevent SSRF attacks. For example, you can implement a custom URL validation function that strictly checks for allowed hosts.
Conclusion
The CVE-2026-25960 vulnerability in vLLM represents a significant risk due to its SSRF protection bypass. Users are strongly advised to update to the latest version to mitigate potential attacks. Additionally, implementing strict URL validation can help reduce the risk until the update is applied.
See every vulnerability recorded for vllm →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to data exposure or unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. This tool allows you to monitor and alert for open-source vulnerabilities in your software without requiring any installation.
If exploited, this vulnerability can allow attackers to access sensitive internal services, leading to data leaks, unauthorized actions, or further exploitation of the system.
While updating to the patched version is the best solution, you can implement additional validation checks on URLs to prevent SSRF attacks as a temporary measure.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
