Server-side Request Forgery in vLLM Inference Engine
CVE-2026-73560

6.5MEDIUM

Key Information:

Vendor

Vllm-project

Status
Vllm
Vendor
CVE Published:
17 August 2026

What is CVE-2026-73560?

The vLLM Inference Engine, utilized for large language model serving, has a vulnerability where the MiMoV2OmniMultiModalProcessor mishandles attacker-controlled image and audio strings. It processes these inputs through functions that can bypass security measures, leading to potential unauthorized access to files on the server. Specifically, the flaw arises due to the direct use of _fetch_image and requests.get methods, which neglect to enforce restrictions established by allowed_media_domains and allowed_local_media_path. This issue has been mitigated in version 0.26.0.

Affected Version(s)

vllm < 0.26.0

References

https://github.com/vllm-project/vllm/security/advisories/...
x_refsource_CONFIRM
https://github.com/vllm-project/vllm/pull/43117
x_refsource_MISC
https://github.com/vllm-project/vllm/commit/54503ecec0f3a...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.