Executive brief
vLLM's MiMoV2OmniMultiModalProcessor lacks SSRF and path validation when loading images or audio from user-supplied URLs and local file paths. An attacker who can control multi_modal_data input can probe internal networks (including cloud metadata services), read local files readable by the vLLM process (e.g., AWS credentials), and generate traffic from the server. This bypasses protections already implemented elsewhere in the codebase.
Technical details
The vulnerability exists in vllm/transformers_utils/processors/mimo_v2_omni.py in the _fetch_image function (lines 231–249) and audio loader (line ~471). These functions call requests.get() directly on HTTP(S) URLs without allowlist validation or Image.open() on file:// paths without path restrictions, bypassing the SSRF and allowed_local_media_path checks in MediaConnector that were previously hardened in CVE-2026-46517, CVE-2026-46518, and related advisories. The vulnerable code is reachable via LLM.generate(multi_modal_data={"image": "http://..."}) and similar batch/library paths. An attacker with control over multi_modal_data can read AWS/GCP/Azure metadata endpoints, probe internal services on 127.0.0.1 or private networks, exfiltrate data via timing oracles, read /etc/passwd or ~/.aws/credentials via file://, or exhaust server resources by hammering arbitrary URLs. The remediation is to route image and audio fetching through MediaConnector.fetch_image/fetch_audio_async, which applies URL allowlists, network-target allowlists, size caps, and local-path allowlists already implemented in earlier patches.
Affected products
- vLLM Project vLLM < 0.26.0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in vLLM 0.26.0