CVE-2026-116176highCWE-918

CVE-2026-116176: fallo de gravedad alta en vllm-project vllm

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear vllm+ Monitorear vllm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.3%
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
vllm-project · vllm
CVEs relacionadas — vllm-project vllm

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-22778CRITICALvLLM leaks a heap address when PIL throws an errorEPSS 18.3%CVE-2025-32444CRITICALvLLM Vulnerable to Remote Code Execution via Mooncake IntegrationEPSS 1.8%CVE-2026-27893HIGHvLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-outEPSS 1.4%CVE-2026-48746CRITICALvLLM: OpenAI auth bypassEPSS 1.2%CVE-2026-22807HIGHvLLM affected by RCE via auto_map dynamic module loading during model initializationEPSS 1.0%CVE-2025-47277CRITICALvLLM Allows Remote Code Execution via PyNcclPipe Communication ServiceEPSS 1.0%