vLLM ist anfällig für Server-Side Request Forgery (SSRF) über die Klasse `MediaConnector`

The SSRF vulnerability in vLLM allows an attacker to leverage the server to scan the internal network. By crafting malicious URLs, an attacker can instruct the vLLM server to make requests to internal services and resources that would otherwise be inaccessible. In containerized environments like llm-d, a compromised vLLM pod could be used to enumerate internal services, potentially leading to the discovery of sensitive information or further exploitation opportunities. The blast radius extends to any internal resources accessible from the vLLM server, posing a significant risk to the overall security posture of the environment.

Organizations deploying vLLM in containerized environments, particularly those utilizing llm-d, are at the highest risk. Environments with lax network segmentation and internal services accessible from the vLLM server are also particularly vulnerable. Users relying on vLLM's multimodal features for processing external media are directly exposed.

• python / llm-d:

Get-Process -Name vLLM | Select-Object -ExpandProperty Path

• python / llm-d: Monitor vLLM logs for unusual outbound network connections or requests to internal IP addresses. • generic web: Use curl to probe for exposed endpoints related to media loading: curl http://<vllmserverip>/media/load • generic web: Examine access logs for requests originating from the vLLM server to internal IP addresses or unexpected domains.

1. 2025-10-07Disclosure

   disclosure

1. Reserviert2025-06-18
2. Veröffentlicht2025-10-07
3. Geändert2026-02-04
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6242 is to upgrade to vLLM version 0.11.0 or later, which includes the necessary fixes to prevent unauthorized URL requests. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound requests from the vLLM server, blocking requests to internal IP addresses or suspicious domains. Additionally, restrict network access to the vLLM pod to only necessary services. Review and tighten URL validation logic within the MediaConnector class if manual patching is attempted, ensuring that only trusted domains are permitted. After upgrade, confirm functionality by attempting to load media from a variety of trusted URLs.