# CVE-2026-116176: vLLM server-side request forgery in X-Request-Id header

Source: https://junglewise.ai/threats/cve-2026-116176-vllm-from-0-9-2-before-0-24-0-contains-a-server-side-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116176 · Severity: high · CVSS 8.2 · Published 2026-10-25

vLLM is a large language model serving framework used to deploy AI models via APIs. A server-side request forgery vulnerability in versions 0.9.2 through 0.24.0 allows attackers to force outbound connections to attacker-controlled hosts by manipulating the X-Request-Id header, potentially exfiltrating cached model data and blocking worker processes.

Technologies: [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm), [vLLM Project vllm](https://junglewise.ai/threats/technologies/vllm-project-vllm). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [vLLM Project](https://junglewise.ai/threats/vendors/vllm-project).

## Quick answers

**Is CVE-2026-116176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116176 being exploited in the wild.

**How severe is CVE-2026-116176?** High severity, with a CVSS score of 8.2, published 25 October 2026.

**Which products and versions are affected?** vllm (PyPI) ECOSYSTEM:introduced=0.9.2,fixed=0.24.0; vLLM Project vllm 0.9.2 to before 0.24.0.

**Is there a fix for CVE-2026-116176?** Yes. vllm (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116176 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116176?** Check whether you run vllm (PyPI) or vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vllm (PyPI): upgrade to 0.24.0 or later

  ```sh
  pip install "vllm>=0.24.0"
  ```


## Technical details

The vulnerability exists in OpenAIServing._base_request_id which copies the X-Request-Id HTTP header directly into the request_id used throughout the engine, and P2pNcclConnector.parse_request_id extracts an attacker-controlled host:port via an unvalidated regex. An API caller (no special privileges required) can embed a routing token in X-Request-Id to force a prefill worker to ZMQ-connect to an attacker host, leaking the NCCL communicator unique_id and KV-cache tensors, or causing denial-of-service by connecting to an unresponsive host.

## Affected products

- vLLM Project vLLM 0.9.2 to before 0.24.0

## Identifiers

- CVE-2026-116176
- GHSA-vfp2-c8pq-v6h6
- PYSEC-2026-4351

## Timeline

- 2026-10-09: disclosed
- 2026-10-25: advisory

## References

- [https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6](https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6)
- [https://www.vulncheck.com/advisories/vllm-0.9.2-before-0.24.0-ssrf-via-x-request-id-in-p2pncclconnector](https://www.vulncheck.com/advisories/vllm-0.9.2-before-0.24.0-ssrf-via-x-request-id-in-p2pncclconnector)

## Related threats

- [vLLM chat template resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-115918-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://junglewise.ai/threats/cve-2026-115917-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM off-by-one error in tokenizer max_token_id validation](https://junglewise.ai/threats/cve-2026-115916-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM image format validation bypass in media processing](https://junglewise.ai/threats/cve-2026-115915-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM denial of service in DeepSeek-OCR image processing](https://junglewise.ai/threats/cve-2026-115914-vllm-is-an-inference-and-serving-engine-for-large-language)