CVE-2026-116176

Name of the Vulnerable Software and Affected Versions vLLM versions 0.9.2 through 0.23.x

Description A server-side request forgery issue allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. This can lead to a P2pNcclConnector prefill worker performing a ZMQ-connect to an attacker-controlled host, resulting in the leakage of the NCCL unique id and KV-cache tensors, or causing the worker to be blocked.

Recommendations Update vLLM to version 0.24.0 or later.