# CVE-2026-24779: vLLM SSRF in MediaConnector via URL parsing discrepancy

Source: https://junglewise.ai/threats/cve-2026-24779-vllm-ssrf-in-mediaconnector-via-url-parsing-discrepancy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-27. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-24779 · Severity: high · CVSS 7.1 · Published 2026-01-27

vLLM, a popular library for serving large language models, is vulnerable to a security flaw that allows attackers to trick the server into making unauthorized requests to internal network resources. By providing a specially crafted URL for media content (like images or video), an attacker can bypass security checks and potentially access sensitive internal data or disrupt other services running in the same environment. This is particularly risky in cloud or containerized environments where the server has access to private management endpoints.

Technologies: [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm), [Red Hat AI Inference Server](https://junglewise.ai/threats/technologies/ai-inference-server), [Vllm](https://junglewise.ai/threats/technologies/vllm). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Vllm](https://junglewise.ai/threats/vendors/vllm).

## Quick answers

**Is CVE-2026-24779 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24779 being exploited in the wild.

**How severe is CVE-2026-24779?** High severity, with a CVSS score of 7.1, published 27 January 2026.

**Which products and versions are affected?** vllm (PyPI) ECOSYSTEM:introduced=0,fixed=0.14.1; Red Hat AI Inference Server 3.2, 3.3.

**Is there a fix for CVE-2026-24779?** Yes. vllm (PyPI): upgrade to 0.14.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24779 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24779?** Check whether you run vllm (PyPI), Red Hat AI Inference Server or Vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vllm (PyPI): upgrade to 0.14.1 or later

  ```sh
  pip install "vllm>=0.14.1"
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector.load_from_url and load_from_url_async methods of vLLM. The vulnerability stems from a differential in how backslashes (\) are handled by Python's urllib.parse (used for validation) and urllib3 (used by the requests library to fetch the content). An attacker with low privileges can provide a crafted URL that passes the hostname allowlist check in urllib but resolves to an internal or restricted IP address when fetched by requests. This allows for internal network scanning, interaction with private metadata endpoints, or unauthorized access to other internal services. The issue is fixed in version 0.14.1.

## Affected products

- vLLM Project vLLM < 0.14.1

## Identifiers

- CVE-2026-24779
- GHSA-qh4c-xf7m-gxfc
- PYSEC-2026-2020

## Timeline

- 2026-01-27: disclosed
- 2026-01-28: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/leishilong](https://api.github.com/users/leishilong)
- [https://github.com/leishilong](https://github.com/leishilong)
- [https://api.github.com/users/leishilong/gists%7B/gist_id%7D](https://api.github.com/users/leishilong/gists%7B/gist_id%7D)
- [https://api.github.com/users/leishilong/repos](https://api.github.com/users/leishilong/repos)
- [https://avatars.githubusercontent.com/u/41693731?v=4](https://avatars.githubusercontent.com/u/41693731?v=4)
- [https://api.github.com/users/leishilong/events%7B/privacy%7D](https://api.github.com/users/leishilong/events%7B/privacy%7D)

## Related threats

- [vLLM chat template resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-115918-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://junglewise.ai/threats/cve-2026-115917-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM off-by-one error in tokenizer max_token_id validation](https://junglewise.ai/threats/cve-2026-115916-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM image format validation bypass in media processing](https://junglewise.ai/threats/cve-2026-115915-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM denial of service in DeepSeek-OCR image processing](https://junglewise.ai/threats/cve-2026-115914-vllm-is-an-inference-and-serving-engine-for-large-language)