CVE-2026-116176

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

Published Oct 25, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

Analysis

Technical impact

The vulnerability is a server‑side request forgery that is triggered by an attacker‑supplied X‑Request‑Id header. By embedding a target address in this header the attacker can cause the vLLM service to establish an outbound ZMQ connection via the P2pNcclConnector. This leads to leakage of sensitive NCCL unique identifiers and KV‑cache tensors or to a blocking of the worker, effectively causing data disclosure and potential denial of service. The weakness is classified as CWE‑918.

Affected Systems

Affected systems are the vLLM project’s vllm component in versions 0.9.2 through 0.23.9‑rc. The vulnerability exists in all builds within that range. The component is deployed in machine learning acceleration environments that use NCCL for communication.

Risk and Exploitability

The CVSS score of 8.8 indicates a high‑severity risk and no EPSS data is currently available. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only to send a crafted request to the API endpoint that forwards X‑Request‑Id headers, which is a characteristic of SSRF; the attack is likely to be feasible in any exposed instance without further authentication, so the risk remains significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vllm-project

vllm

unaffected

Version	Status	Constraints
`0.9.2`	affected	< 0.24.0
`0.24.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Vllm

Version	Status	Scheme	Platform
`[0.9.2,0.24.0)`	affected	semver	—
`0.24.0`	unaffected	semver	—

Vllm-project

Vllm

Version	Status	Scheme	Platform
`[0.9.2,0.24.0)`	affected	semver	—
`0.24.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the vLLM component to version 0.24.0 or later, which removes the vulnerable P2pNcclConnector behavior.
If an upgrade is not immediately possible, restrict traffic to the vLLM API to trusted networks and block any outbound ZMQ connections that are not explicitly required.
Sanitize or reject X‑Request‑Id header values that contain URLs or non‑alphanumeric characters, and consider removing the header from forwarded API requests entirely.

Generated by OpenCVE AI on October 25, 2026 at 16:39 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.318% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6
https://nvd.nist.gov/vuln/detail/CVE-2026-116176
https://www.cve.org/CVERecord?id=CVE-2026-116176
https://www.vulncheck.com/advisories/vllm-0.9.2-before-0.24.0-ssrf-via-x-request-id-in-p2pncclconnector

History

Nov 4, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116176 https://www.cve.org/CVERecord?id=CVE-2026-116176
Metrics	threat_severity `None`	threat_severity `Important`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vllm-project Vllm-project vllm
Vendors & Products		Vllm-project Vllm-project vllm

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.
Title		vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
First Time appeared		Vllm Vllm vllm
Weaknesses		CWE-918
CPEs		cpe:2.3:a:vllm:vllm::::::::
Vendors & Products		Vllm Vllm vllm
References		https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6 https://www.vulncheck.com/advisories/vllm-0.9.2-before-0.24.0-ssrf-via-x-request-id-in-p2pncclconnector
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N'}`