Executive brief
vLLM is a high-throughput engine for serving large language models. A security flaw in its batch processing component allows an attacker to force the server to make unauthorized web requests to internal or external addresses. This could lead to the exposure of sensitive internal data, such as cloud metadata or internal API information, potentially compromising the underlying infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) exists in the `download_bytes_from_url` function within `vllm/entrypoints/openai/run_batch.py`. The vulnerability is caused by a lack of validation for the `file_url` field in `BatchTranscriptionRequest` and `BatchTranslationRequest` objects. An attacker who can provide a malicious batch input JSON file can specify arbitrary URLs (including internal IP addresses or cloud metadata endpoints) which the server will then fetch using the `aiohttp` library. This occurs because the function only checks the URL scheme (http/https/data) but does not enforce domain restrictions or IP allowlists. The issue is addressed in version 0.19.0.
Affected products
- vllm-project vllm >= 0.16.0, < 0.19.0
Timeline
- 2026-04-03: advisory: GitHub Advisory GHSA-pf3h-qjgv-vcpr published
- 2026-04-03: disclosed
- 0.19.0: patched