Summary
A server-side request forgery vulnerability in vLLM allows an API caller to influence a decode address through the X-Request-Id header. In affected distributed inference configurations, this may force a P2pNcclConnector prefill worker to connect to an attacker-controlled host, exposing NCCL connection data and KV-cache tensors or disrupting the worker.
A server-side request forgery vulnerability in vLLM allows an API caller to influence a decode address through the X-Request-Id header. In affected distributed inference configurations, this may force a P2pNcclConnector prefill worker to connect to an attacker-controlled host, exposing NCCL connection data and KV-cache tensors or disrupting the worker.
Affected context
The issue occurs in vLLM deployments that use the P2pNcclConnector prefill-worker communication path and process attacker-influenced request identifiers as connection addresses. Risk depends on whether API callers can submit crafted header values and whether worker nodes are permitted to make outbound connections to untrusted destinations.
The issue occurs in vLLM deployments that use the P2pNcclConnector prefill-worker communication path and process attacker-influenced request identifiers as connection addresses. Risk depends on whether API callers can submit crafted header values and whether worker nodes are permitted to make outbound connections to untrusted destinations.
Exploit preconditions
- Attack surface: vLLM API handling of the X-Request-Id header
- Required access: Ability to send requests to the affected API endpoint
- Trigger point: Processing of a decode address used by the P2pNcclConnector
- Network condition: The worker must be able to establish outbound connections to the selected destination
- Why exploitation is possible: Attacker-controlled address data is used to initiate a worker-side connection without adequate destination restrictions
- Attack surface: vLLM API handling of the X-Request-Id header
- Required access: Ability to send requests to the affected API endpoint
- Trigger point: Processing of a decode address used by the P2pNcclConnector
- Network condition: The worker must be able to establish outbound connections to the selected destination
- Why exploitation is possible: Attacker-controlled address data is used to initiate a worker-side connection without adequate destination restrictions
Why this happens
The vulnerability results from insufficient validation and trust-boundary enforcement for an address derived from an HTTP request header. A server-side component uses that value to initiate an outbound ZMQ connection, allowing an API caller to redirect network activity toward an attacker-selected host.
This maps to CWE-918: Server-Side Request Forgery, where externally supplied input influences server-side requests without sufficient validation, authorization, or network egress controls.
The vulnerability results from insufficient validation and trust-boundary enforcement for an address derived from an HTTP request header. A server-side component uses that value to initiate an outbound ZMQ connection, allowing an API caller to redirect network activity toward an attacker-selected host.
This maps to CWE-918: Server-Side Request Forgery, where externally supplied input influences server-side requests without sufficient validation, authorization, or network egress controls.
Potential impact
- An attacker may obtain the NCCL unique_id exchanged during worker coordination
- KV-cache tensors could be exposed to an attacker-controlled destination
- A malicious endpoint could capture or manipulate protocol traffic
- The affected prefill worker could be blocked or made unavailable
- Distributed inference workloads could experience service disruption
- Compromised connection metadata could support further attacks against the deployment
- An attacker may obtain the NCCL unique_id exchanged during worker coordination
- KV-cache tensors could be exposed to an attacker-controlled destination
- A malicious endpoint could capture or manipulate protocol traffic
- The affected prefill worker could be blocked or made unavailable
- Distributed inference workloads could experience service disruption
- Compromised connection metadata could support further attacks against the deployment
General mitigation guidance
Mitigation generally focuses on preventing request-derived values from controlling internal connection destinations.
Common defensive patterns include:
- Treating request headers as untrusted data and avoiding their direct use as network addresses
- Allowing connections only to explicitly configured, authenticated worker endpoints
- Validating addresses against an allowlist of expected hosts, ports, and protocols
- Applying network egress policies that restrict worker connections to required destinations
- Separating control-plane request handling from internal worker coordination
- Limiting worker privileges and isolating inference workloads from sensitive network segments
- Protecting NCCL identifiers and KV-cache data with appropriate transport and access controls
Mitigation generally focuses on preventing request-derived values from controlling internal connection destinations.
Common defensive patterns include:
- Treating request headers as untrusted data and avoiding their direct use as network addresses
- Allowing connections only to explicitly configured, authenticated worker endpoints
- Validating addresses against an allowlist of expected hosts, ports, and protocols
- Applying network egress policies that restrict worker connections to required destinations
- Separating control-plane request handling from internal worker coordination
- Limiting worker privileges and isolating inference workloads from sensitive network segments
- Protecting NCCL identifiers and KV-cache data with appropriate transport and access controls
How teams detect issues like this
Detection can include:
- Static analysis for request-header values flowing into socket, ZMQ, HTTP, or RPC connection APIs
- Code review checks for dynamic host or port construction from externally supplied fields
- Runtime logging of worker connection destinations, with alerting for unexpected external addresses
- Network monitoring for inference workers initiating connections outside approved destinations
- Policy enforcement requiring explicit endpoint allowlists for distributed worker communication
- Automated security testing that checks whether untrusted headers can influence outbound requests
Detection can include:
- Static analysis for request-header values flowing into socket, ZMQ, HTTP, or RPC connection APIs
- Code review checks for dynamic host or port construction from externally supplied fields
- Runtime logging of worker connection destinations, with alerting for unexpected external addresses
- Network monitoring for inference workers initiating connections outside approved destinations
- Policy enforcement requiring explicit endpoint allowlists for distributed worker communication
- Automated security testing that checks whether untrusted headers can influence outbound requests
