CVE-2026-34753

MEDIUM

vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-34753 has a selected CVSS score of 5.4 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host. This vulnerability is fixed in 0.19.0.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 7, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

vllm

Browse vllm-project / vllm
CVE List>= 0.16.0, < 0.19.0affected

vllm

Browse PyPI / vllm
GitHub Advisory0.16.0 to < 0.19.0 · Fixed in 0.19.0affected

Proofs of concept

1

Repository PoCs

GitHubDhiaelhak-Rached/CVE-2026-34753Repository PoCby Dhiaelhak-Rached0Exploit8 files

5.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a lab environment that demonstrates exploitation of CVE-2026-34753, an SSRF vulnerability in vLLM. It includes a vulnerable mock server (victim/app.py) that replicates the vulnerable download_bytes_from_url function, an internal mock metadata service (victim/metadata.py), and an attacker script (attacker/attack.sh) that sends a crafted JSON payload to trigger the SSRF and fetch data from the internal service.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept (PoC) for CVE-2026-34753, an SSRF vulnerability in vLLM. The attacker script (attack.sh) sends a crafted request to a local victim service, and the victim code (app.py) demonstrates the vulnerable function. The metadata.py file simulates an internal metadata service. No backdoor, trojan, or deceptive behavior targeting the PoC operator was observed; all code serves the stated educational/demonstration purpose.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonShell
Target softwarevLLM
Attack typesServer-Side Request Forgery (SSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains an attacker script (attack.sh) that sends a crafted request to a vulnerable endpoint, and a victim server (app.py) that executes the vulnerable code path to fetch attacker-controlled URLs. This constitutes an exploit because it exercises the vulnerability to cause the server to make requests to internal services, which is the intended malicious action.

attacker/attack.sh:14-17victim/app.py:27-36victim/app.py:57

Requirements

  • The attacker must be able to send HTTP requests to the vulnerable vLLM batch endpoint (/v1/batch).attacker/attack.sh:15
  • The attacker must control the 'file_url' field in the batch input JSON.victim/app.py:52

Observed behavior

  • The attacker script sends a POST request to the victim's /v1/batch endpoint with a JSON payload containing a file_url pointing to an internal service (e.g., http://metadata:8080/latest/meta-data/iam/security-credentials/).attacker/attack.sh:14-17
  • The vulnerable server makes an HTTP GET request to the attacker-supplied URL without any validation, fetches the response, and returns a preview of the fetched data in its JSON response.victim/app.py:27-36victim/app.py:57-69
  • The internal metadata service simulates an AWS EC2 metadata endpoint and returns mock credentials when queried.victim/metadata.py:6-14
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldTarget URL for the SSRF demonstration, hardcoded in attack.sh and app.py.attacker/attack.sh:3victim/app.py:83
Url
Payload withheldSimulated internal metadata service endpoint, used to demonstrate SSRF impact.victim/metadata.py:21
Credential
Payload withheldExample AWS credentials returned by the simulated metadata service; clearly fake and for demonstration only.victim/metadata.py:10-11
Review boundaries

What the analysis did not establish

  • The evidence does not include the actual exploit.jsonl payload file referenced by attack.sh, so the exact content of the SSRF request is not visible.
  • The victim server is a mock implementation, not the actual vLLM codebase, so the exploit's behavior against a real vLLM instance is not directly observed.
  • The evidence is a lab setup and does not demonstrate exploitation against a live, production system.
  • Four additional files (total 8) were omitted from the text evidence; their metadata indicates they are non-text or not selected, but their content was not reviewed.
  • Binary content, if any, was flagged as metadata-only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Dhiaelhak-Rached/CVE-2026-34753Created Vuln labCVE-2026-34753Compose · builds

1 Compose manifest · 2 Dockerfiles · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with two services: a victim service running a mock vLLM batch API vulnerable to SSRF, and an attacker service that sends an exploit payload to the victim to fetch internal cloud metadata.

docker-compose.yml:1-25

Lab assessment

Vulnerability lab

The environment explicitly references CVE-2026-34753, contains a vulnerable code snippet from vLLM, and provides an attacker container with an exploit script targeting the victim's SSRF vulnerability to demonstrate credential theft from an internal metadata service.

attacker/attack.sh:2victim/app.py:7-9attacker/exploit.jsonl:1
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

victim

vulnerable batch API serverinternal metadata service

Runs a Python aiohttp server on port 8000 exposing a /v1/batch endpoint that accepts a file_url and fetches it without validation (SSRF). Also runs a separate metadata service on 127.0.0.1:8080 that simulates AWS EC2 instance metadata, returning fake credentials.

victim/app.py:1-86victim/metadata.py:1-21victim/start.sh:1-3

attacker

exploit launcher

Container with curl and an attack script that sends a crafted JSONL payload to the victim's /v1/batch endpoint, causing it to fetch internal metadata from http://127.0.0.1:8080/latest/meta-data/iam/security-credentials/admin-role.

attacker/Dockerfile:1-6attacker/attack.sh:1-27attacker/exploit.jsonl:1
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-34753

Supported by supplied evidence

The victim's app.py contains a download_bytes_from_url function that fetches arbitrary HTTP/HTTPS URLs without validation, matching the SSRF vulnerability described in CVE-2026-34753. The exploit demonstrates fetching internal metadata.

victim/app.py:7-9victim/app.py:24-33attacker/exploit.jsonl:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.docker-compose.yml:1
  • The victim service must be running and reachable by the attacker on the vuln-lab network.docker-compose.yml:5-10

Evidence-described exercise path

  1. Build and start the environment with docker-compose up.docker-compose.yml:1-25
  2. Execute the attack script inside the attacker container: ./attack.shattacker/Dockerfile:6attacker/attack.sh:1-27
  3. The script sends a POST request to http://victim:8000/v1/batch with a JSONL body containing a file_url pointing to the internal metadata service.attacker/attack.sh:12-15attacker/exploit.jsonl:1
  4. The victim's batch handler calls download_bytes_from_url with the attacker-supplied URL, fetching the internal metadata and returning it in the response, demonstrating SSRF and credential leakage.victim/app.py:42-60
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's internal Docker network. The attacker targets only the victim container's internal service, and no host escape, external connectivity, persistence, or destructive actions are present. The port mapping (8000:8000) is a documented lab requirement for the batch API.

docker-compose.yml:8-9attacker/attack.sh:12-15victim/metadata.py:17
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

8