SSRF in Vllm
CVE-2026-34753
vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host. This vulnerability is fixed in 0.19.0.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.002 (15.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L.
Affected products
- Vllm
- Vllm-project Vllm — versions >= 0.16.0, < 0.19.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-34753?
- CVE-2026-34753 is a medium-severity vulnerability in Vllm, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.4/10. Published 2026-04-06.
- How severe is CVE-2026-34753?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2026-34753 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.