CVE-2026-73560 Overview
CVE-2026-73560 is a Server-Side Request Forgery (SSRF) vulnerability in vLLM, an inference and serving engine for large language models. The flaw resides in the MiMoV2OmniMultiModalProcessor located at vllm/transformers_utils/processors/mimo_v2_omni.py. Attacker-controlled image and audio strings flow into _fetch_image, requests.get, and Image.open instead of routing through MediaConnector. This bypasses the allowed_media_domains and allowed_local_media_path protections. Authenticated attackers can force the vLLM process to issue arbitrary outbound requests and read local files accessible to its user context. The issue is fixed in vLLM version 0.26.0.
Critical Impact
Authenticated users can trigger server-side requests to internal endpoints and read arbitrary files reachable by the vLLM process, exposing cloud metadata, credentials, and model artifacts.
Affected Products
- vLLM inference and serving engine, all versions prior to 0.26.0
- Deployments exposing the MiMoV2Omni multimodal processor endpoint
- LLM serving stacks that consume attacker-supplied image or audio URLs
Discovery Timeline
- 2026-08-17 - CVE-2026-73560 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-73560
Vulnerability Analysis
vLLM implements a MediaConnector abstraction to validate remote and local media references. It enforces allowed_media_domains for outbound fetches and allowed_local_media_path for local reads. The MiMoV2OmniMultiModalProcessor bypasses this control layer. It passes user-supplied image and audio strings directly to _fetch_image, requests.get, and Image.open. As a result, no domain allowlisting or path restriction applies to inputs handled by this processor. An authenticated client submitting a multimodal inference request can supply arbitrary URLs or file paths. The processor then performs the outbound HTTP request or file read on the server. This maps to [CWE-918] Server-Side Request Forgery.
Root Cause
The root cause is missing use of the centralized MediaConnector inside MiMoV2OmniMultiModalProcessor. Media inputs skip the sanitization and allowlist checks applied elsewhere in the codebase. Direct calls to requests.get and Image.open on untrusted strings remove all protocol, domain, and path validation.
Attack Vector
An authenticated attacker submits an inference request containing crafted image or audio references. The server issues HTTP requests to attacker-chosen destinations, including internal-only services such as cloud instance metadata endpoints. The same code path accepts local file paths, letting attackers read files readable by the vLLM process user. Confidentiality impact is high, while integrity and availability are not directly affected.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-4hhp-h66f-j5j7 for advisory details and the remediation pull request for the code-level fix.
Detection Methods for CVE-2026-73560
Indicators of Compromise
- Outbound HTTP connections from vLLM hosts to cloud metadata addresses such as 169.254.169.254 or internal RFC1918 endpoints.
- Inference request payloads containing file://, http://localhost, or unexpected internal hostnames in image or audio fields.
- vLLM process file reads outside expected model and cache directories.
Detection Strategies
- Inspect vLLM API request logs for image or audio URL fields referencing non-allowlisted domains or local file schemes.
- Correlate multimodal inference requests with subsequent egress connections from the serving host.
- Alert on open() or requests.get activity in the vLLM process targeting paths or hosts outside the configured allowlists.
Monitoring Recommendations
- Forward vLLM application logs and host network telemetry into a centralized analytics pipeline for correlation.
- Baseline normal egress destinations from inference nodes and alert on new outbound targets.
- Monitor file access telemetry on inference servers for reads of /etc, SSH keys, and cloud credential files.
How to Mitigate CVE-2026-73560
Immediate Actions Required
- Upgrade vLLM to version 0.26.0 or later, which routes MiMoV2Omni media inputs through MediaConnector.
- Restrict network egress from vLLM hosts to only required model registries and object stores.
- Block access to cloud instance metadata services from the inference process using IMDSv2 or host firewalls.
- Require authentication and rate limiting on all vLLM API endpoints exposed to users.
Patch Information
The fix is included in vLLM release v0.26.0. The relevant remediation is tracked in the upstream commit 54503ec and the pull request #43117. Operators running any release before 0.26.0 should upgrade immediately.
Workarounds
- Disable or remove the MiMoV2Omni multimodal processor path if upgrading is not immediately feasible.
- Run vLLM under a dedicated low-privilege user with read access limited to the model and cache directories.
- Deploy an egress proxy that enforces an allowlist of permitted media domains for the vLLM process.
# Configuration example
pip install --upgrade 'vllm>=0.26.0'
# Verify installed version
python -c "import vllm; print(vllm.__version__)"
# Example host-level egress restriction blocking cloud metadata
iptables -A OUTPUT -m owner --uid-owner vllm -d 169.254.169.254 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
