Executive brief
vLLM, a popular library for serving large language models, is vulnerable to a security flaw that allows attackers to trick the server into making unauthorized requests to internal network resources. By providing a specially crafted URL for media content (like images or video), an attacker can bypass security checks and potentially access sensitive internal data or disrupt other services running in the same environment. This is particularly risky in cloud or containerized environments where the server has access to private management endpoints.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector.load_from_url and load_from_url_async methods of vLLM. The vulnerability stems from a differential in how backslashes (\) are handled by Python's urllib.parse (used for validation) and urllib3 (used by the requests library to fetch the content). An attacker with low privileges can provide a crafted URL that passes the hostname allowlist check in urllib but resolves to an internal or restricted IP address when fetched by requests. This allows for internal network scanning, interaction with private metadata endpoints, or unauthorized access to other internal services. The issue is fixed in version 0.14.1.
Affected products
- vLLM Project vLLM < 0.14.1
Timeline
- 2026-01-27: disclosed
- 2026-01-28: advisory: GitHub Advisory published