CVE-2026-25960

vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.

An adversary identifies an organization running vLLM 0.17.0 via exposed API endpoint fingerprinting or job posting metadata. They craft a URL using URL encoding tricks, IPv6 literals, or protocol-relative notation that passes urllib3.util.parse_url() hostname validation but resolves differently when yarl (aiohttp's internal parser) processes it — specifically redirecting to http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS. The request is submitted to the vLLM model loading API endpoint with no authentication. vLLM's load_from_url_async fetches the URL via aiohttp, receives AWS temporary IAM credentials, and the response is returned or logged. The attacker harvests the credentials, enumerates S3 buckets containing model weights and training data, and uses the IAM role to pivot deeper into the organization's AI infrastructure or broader AWS environment.