CVE-2026-73560

Katalog CVE

CVSS 6.5 · Medium EPSS 0,41%

Kerentanan Server-Side Request Forgery (SSRF) pada vllm. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-4hhp-h66f-j5j7 mitigasi · advisory vendor
• https://github.com/vllm-project/vllm/commit/54503ecec0f3ac31e5ecfc5f28652e4cc42307b5 patch
• https://github.com/vllm-project/vllm/pull/43117 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 release notes