{"id":"CVE-2026-116176","kind":"vulnerability","aliases":["CVE-2026-116176"],"related":[],"title":"vLLM: X-Request-Id header lets API callers force outbound connections","description":"vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.","summary":"vLLM from 0.9.2 before 0.24.0 lets an API caller embed a decode address in the X-Request-Id header, forcing a P2pNcclConnector prefill worker to connect to an attacker-chosen host. An attacker can leak the NCCL unique_id and KV-cache tensors, or block the worker.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-inference","ai-tooling","python","self-hosted","vllm"],"not_affected_if":["version-0.24.0-or-later"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"`\n- Check whether disaggregated prefill with P2pNcclConnector is enabled in the serving configuration (unknown if the sources do not say how to find it)","fix":"- Upgrade vLLM to `0.24.0` or later\n- unknown for interim mitigations; the sources do not list any","status":"open","published_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:13+00:00","updated_at":"2026-10-25T14:42:13+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T14:42:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.24.0` or later\n- unknown for interim mitigations; the sources do not list any","reach":"internet","title":"vLLM: X-Request-Id header lets API callers force outbound connections","impact":"medium","summary":"vLLM from 0.9.2 before 0.24.0 lets an API caller embed a decode address in the X-Request-Id header, forcing a P2pNcclConnector prefill worker to connect to an attacker-chosen host. An attacker can leak the NCCL unique_id and KV-cache tensors, or block the worker.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","self-hosted","ai-inference","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker leaks KV-cache tensors and NCCL unique_id, or blocks the worker.","analyst_note":"Confirm whether P2pNcclConnector is required to trigger the flaw and whether authentication is needed; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116176 and the vLLM release notes for 0.24.0.","how_to_check":"- Check the installed vLLM version with `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"`\n- Check whether disaggregated prefill with P2pNcclConnector is enabled in the serving configuration (unknown if the sources do not say how to find it)","needs_analyst":true,"not_affected_if":["version-0.24.0-or-later"],"who_is_affected":"Teams running vLLM from 0.9.2 up to but not including 0.24.0 that expose its API to callers who can send request headers. The sources tie the flaw to the P2pNcclConnector prefill worker path, so deployments that do not use that connector are likely less exposed, but the sources do not confirm this. Teams on 0.24.0 or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":3355,"output_tokens":703,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116176':15A,18A '-2026':14A,17A '0.24.0':34B,84C '0.9.2':32B,82C 'address':42B,105C 'ai':20B,23B 'ai-infer':19B 'ai-tool':22B 'allow':94C 'api':8A,37B,95C 'attack':60B,64B,113C,125C 'attacker-chosen':59B 'block':77B,138C 'cach':74B,135C 'caller':9A,38B,96C 'chosen':61B 'connect':12A,56B,100C,122C 'contain':85C 'cve':13A,16A 'decod':41B,104C 'emb':39B 'embed':102C 'forc':10A,50B,98C 'forgeri':91C 'header':6A,49B,112C 'host':28B,62B,126C 'id':5A,48B,70B,111C,131C 'infer':21B 'kv':73B,134C 'kv-cach':72B,133C 'leak':66B,127C 'let':7A,35B 'make':115C 'nccl':68B,129C 'outbound':11A,99C 'p2pncclconnector':52B,117C 'prefil':53B,118C 'python':25B 'request':4A,47B,90C,110C 'self':27B 'self-host':26B 'server':88C 'server-sid':87C 'side':89C 'tensor':75B,136C 'tool':24B 'uniqu':69B,130C 'vllm':1A,29B,30B,80C 'vulner':92C 'worker':54B,79B,119C,140C 'x':3A,46B,109C 'x-request-id':2A,45B,108C 'zmq':121C 'zmq-connect':120C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM from 0.9.2 up to but not including 0.24.0 that expose its API to callers who can send request headers. The sources tie the flaw to the P2pNcclConnector prefill worker path, so deployments that do not use that connector are likely less exposed, but the sources do not confirm this. Teams on 0.24.0 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116176","severity":null,"published_at":"2026-10-25T14:16:57+00:00","modified_at":"2026-10-25T14:16:57+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}