Description

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T21:16:48.960Z",
  "pubdate": "2026-08-17T21:16:48.960Z",
  "executiveSummary": "A security vulnerability exists in vLLM prior to version 0.26.0 involving the MiMoV2OmniMultiModalProcessor component. The flaw is classified as a Server-Side Request Forgery (SSRF) and arbitrary file read vulnerability. It arises from improper handling of media input parameters, specifically bypassing security mechanisms such as allowed_media_domains and allowed_local_media_path restrictions. An unauthenticated attacker capable of sending inference requests containing malicious multimodal payloads can exploit this vulnerability to force the vLLM inference and serving engine to perform arbitrary HTTP requests to internal or external resources and read arbitrary files accessible to the local vLLM process. The impact includes unauthorized access to sensitive internal network services and exposure of confidential host system files. Remediation requires upgrading vLLM to version 0.26.0 or later, where media handling is properly secured through the MediaConnector abstraction.",
  "technicalDetails": "The vulnerability resides within the MiMoV2OmniMultiModalProcessor implemented in vllm/transformers_utils/processors/mimo_v2_omni.py. In affected versions prior to 0.26.0, the processor fails to utilize the secure MediaConnector mechanism for processing multimodal inputs. Instead, it directly passes attacker-controlled image and audio string inputs through insecure retrieval functions, specifically invoking _fetch_image, requests.get, and PIL.Image.open.\nThis architectural flaw completely bypasses the security controls designed to restrict media retrieval, namely the allowed_media_domains and allowed_local_media_path configurations. Because the input strings are not validated against these whitelists or restricted URI schemes, the application can be coerced into resolving arbitrary resource locators provided in the payload.\nThe attack flow proceeds as follows: An attacker crafts a malicious inference request containing specially formulated strings in place of legitimate image or audio inputs. These strings can utilize file URI schemes or internal network addresses. When the MiMoV2OmniMultiModalProcessor processes the request, it executes requests.get or Image.open on the attacker-supplied string without domain or path validation. If a local file path (such as /etc/passwd or application configuration files) is supplied, PIL.Image.open or file-handling routines read the file contents and incorporate or process them within the inference pipeline. If an internal network URL or metadata endpoint is supplied via HTTP, requests.get triggers an outbound HTTP request from the server hosting the vLLM engine, facilitating Server-Side Request Forgery (SSRF).\nThe vulnerability affects vLLM versions prior to 0.26.0. Exploitation requires network exposure to the vLLM inference API endpoint, but typically does not require prior authentication or elevated privileges, depending on the deployment configuration. Post-exploitation impact includes the exfiltration of sensitive local files readable by the user running the vLLM process and internal network reconnaissance or interaction with unprotected internal microservices."
}