High 8.2Published Oct 25, 2026

CVE-2026-116176vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

Updated under an hour ago (Oct 30, 2026, 3:10 AM ET)

Does this affect you?

It affects vllm-project vllm and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.32%, higher than 25% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for vllm-project vllm Exploited in the last 30 days

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

CVSS: 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.32% (percentile 25)
Assigned by: VulnCheck
NVD analysis: Analyzed
Record last updated: Oct 25, 2026
First seen by InfoSec Signals: Oct 25, 2026

Affected products

Affected products

vllm-project vllm vllm_project:vllm (from the name)	from 0.9.2 before 0.24.0; 0.24.0 not affected	CNA record
vllm vllm vllm:vllm	from 0.9.2 before 0.24.0	NVD

References

References

https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6	vendor-advisory
https://www.vulncheck.com/advisories/vllm-0.9.2-before-0.24.0-ssrf-via-x-request-id-in-p2pncclconnector	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.