CVE-2026-116176: vLLM: SSRF via X-Request-Id leaks NCCL KV-cache data

HIGH

Published October 25, 2026

CISO Take

CVE-2026-116176 is a server-side request forgery in vLLM 0.9.2 through 0.23.x where an unauthenticated API caller can embed a decode address in the X-Request-Id header and make a P2pNcclConnector prefill worker open a ZMQ connection to an attacker-controlled host. That can leak the NCCL unique_id and KV-cache tensors, which hold fragments of other users' prompts and model context, or hang the worker. It is rated high (CVSS 8.2) and needs no privileges or user interaction, but it only affects disaggregated prefill/decode deployments using P2pNcclConnector. There is no EPSS score, no public exploit, no Nuclei template and no KEV listing at publication, so the risk is real but not yet observed in the wild. Upgrade to vLLM 0.24.0 or later, and until then keep prefill workers off the internet, strip or validate X-Request-Id at the gateway, and restrict worker egress to known decode nodes.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High. The attack is network-reachable, low complexity and needs no authentication (AV:N/AC:L/PR:N/UI:N). Confidentiality impact is high because KV-cache tensors can contain content from other tenants' requests, and availability impact is low because a worker can be blocked. The exposure window is limited to deployments that enable the P2pNcclConnector for disaggregated prefill/decode and expose the API to untrusted callers. Exploitation data is absent (EPSS N/A, no public PoC, not in KEV), so likelihood is moderate and may rise once the advisory details circulate.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated request to an exposed vLLM API with a crafted X-Request-Id header containing an attacker-controlled decode address.

AML.T0049

Exploitation

The P2pNcclConnector prefill worker trusts the header and opens a ZMQ connection to the attacker's host (SSRF).

AML.T0040

Collection

The attacker's listener captures the NCCL unique_id and receives KV-cache tensors from the worker.

AML.T0025

Impact

Prompt and context data from users is reconstructed from the tensors, or the prefill worker is blocked, degrading service.

AML.T0057

Initial Access

Attacker sends an unauthenticated request to an exposed vLLM API with a crafted X-Request-Id header containing an attacker-controlled decode address.

AML.T0049

Exploitation

The P2pNcclConnector prefill worker trusts the header and opens a ZMQ connection to the attacker's host (SSRF).

AML.T0040

Collection

The attacker's listener captures the NCCL unique_id and receives KV-cache tensors from the worker.

AML.T0025

Impact

Prompt and context data from users is reconstructed from the tensors, or the prefill worker is blocked, degrading service.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ALow

What should I do?

1 step

1) Upgrade vLLM to 0.24.0 or later (affected: 0.9.2 up to but excluding 0.24.0). 2) Inventory deployments that use kv_connector P2pNcclConnector or disaggregated prefill. 3) Until patched, have the reverse proxy or API gateway drop or regex-validate X-Request-Id (for example, allow only UUID or alphanumeric values) so it cannot carry host:port data. 4) Place prefill and decode workers on an isolated network segment and apply egress allow-lists so workers can connect only to approved decode nodes and ZMQ ports. 5) Require authentication on the vLLM API endpoint and do not expose it directly to the internet. 6) Detect: alert on X-Request-Id values containing IP addresses, hostnames or colons, and on outbound ZMQ/TCP connections from prefill workers to unknown destinations. 7) Treat NCCL unique_ids as secrets and restart affected workers after patching to rotate them.

How is it classified?

Data LeakageDoSData ExtractionInferenceAPIFrameworkAML.T0025- Exfiltration via Cyber Means AML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application AML.T0057- LLM Data Leakage

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and unknown risksMEASURE 2.7-AI system security and resilience are evaluated

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-116176?

Is CVE-2026-116176 actively exploited?

No confirmed active exploitation of CVE-2026-116176 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-116176?

1) Upgrade vLLM to 0.24.0 or later (affected: 0.9.2 up to but excluding 0.24.0). 2) Inventory deployments that use kv_connector P2pNcclConnector or disaggregated prefill. 3) Until patched, have the reverse proxy or API gateway drop or regex-validate X-Request-Id (for example, allow only UUID or alphanumeric values) so it cannot carry host:port data. 4) Place prefill and decode workers on an isolated network segment and apply egress allow-lists so workers can connect only to approved decode nodes and ZMQ ports. 5) Require authentication on the vLLM API endpoint and do not expose it directly to the internet. 6) Detect: alert on X-Request-Id values containing IP addresses, hostnames or colons, and on outbound ZMQ/TCP connections from prefill workers to unknown destinations. 7) Treat NCCL unique_ids as secrets and restart affected workers after patching to rotate them.

What systems are affected by CVE-2026-116176?

This vulnerability affects the following AI/ML architecture patterns: LLM model serving, Disaggregated prefill/decode inference, Multi-tenant inference gateways, GPU inference clusters with NCCL KV transfer.

What is the CVSS score for CVE-2026-116176?

CVE-2026-116176 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

LLM model servingDisaggregated prefill/decode inferenceMulti-tenant inference gatewaysGPU inference clusters with NCCL KV transfer

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

AML.T0057LLM Data Leakage

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3, MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM10

What are the technical details?

Original Advisory

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

Exploitation Scenario

An attacker finds an exposed vLLM OpenAI-compatible endpoint backed by disaggregated prefill/decode. They send a normal chat completion request with an X-Request-Id header that encodes the address of a host they control. The prefill worker parses the header, treats it as the decode peer, and ZMQ-connects to the attacker's listener. The attacker's server completes the handshake, records the NCCL unique_id, and receives KV-cache tensors for the request and potentially for concurrent sessions. They reconstruct prompt content or sensitive context from the tensors. Alternatively, they point the address at a black-hole host so the worker stalls and repeat the request to degrade service.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.