vLLM: Server-side request forgery via X-Request-Id in P2pNcclConnector
Summary
vLLM versions from 0.9.2 before 0.24.0 contain a server-side request forgery (SSRF) vulnerability in the P2pNcclConnector. An API caller can embed a decode address in the X-Request-Id header, forcing a prefill worker to connect to an attacker-controlled host. This can leak the NCCL unique_id and KV-cache tensors, which may include prompt data, or block the worker. The vulnerability requires the P2pNcclConnector to be configured and access to the API, which needs only a valid API key or no key if none is set.
Affected
- vLLM (PyPI package vllm) from 0.9.2 before 0.24.0
- Only deployments using the P2pNcclConnector are affected
- Red Hat AI Inference Server is listed as affected by one tracker; not verified against Red Hat's advisory
- Unknown: whether versions before 0.9.2 are affected
Fixed in
- Upgrade to vLLM 0.24.0 or later
- Unknown: fixed build of Red Hat AI Inference Server
Workaround
- No official workaround found.
- The advisory proposes a source-code change that strips or replaces X-Request-Id when P2pNcclConnector is active; this is only practical if you maintain vLLM from source.
Exploitation
- CVSS 4.0 vector indicates network attack, low complexity, no privileges and no user interaction.
- Known exploited (KEV): No.
- No public proof of concept found in the research; this cannot be fully ruled out.
Our recommendation
- Check whether any vLLM deployment uses P2pNcclConnector (KV-transfer configuration); if not, the advisory's conditions do not apply.
- Upgrade affected vLLM installations to 0.24.0 or later, ideally the current release, and test behaviour changes after upgrading.
- Keep the vLLM API off untrusted networks and place it behind an authenticating reverse proxy.
- Restrict outbound connections from prefill workers to known hosts.
- Treat multi-node or disaggregated deployments with internet or less-trusted exposure as high priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vfp2-c8pq-v6h6 github.com
- VulnCheck advisory www.vulncheck.com
- OSV PYSEC-2026-4351 osv.dev
- VulDB CVE-2026-116176 vuldb.com
- NixOS nixpkgs issue 579137 (CVSS vector) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:36.
Original description (NVD)
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.