Summary
NVIDIA TensorRT-LLM contains a server-side request forgery vulnerability that may allow an attacker to make the server issue unintended requests to internal or external resources. A successful exploit could disclose information accessible from the server's network position, particularly when attacker-controlled input reaches request-handling functionality.
NVIDIA TensorRT-LLM contains a server-side request forgery vulnerability that may allow an attacker to make the server issue unintended requests to internal or external resources. A successful exploit could disclose information accessible from the server's network position, particularly when attacker-controlled input reaches request-handling functionality.
Affected context
The vulnerability affects deployments where NVIDIA TensorRT-LLM exposes server functionality that processes attacker-influenced resource identifiers, URLs, or request parameters. Risk is higher when the service can reach internal networks, cloud metadata endpoints, administrative interfaces, or other resources that are not directly accessible to the requester.
The vulnerability affects deployments where NVIDIA TensorRT-LLM exposes server functionality that processes attacker-influenced resource identifiers, URLs, or request parameters. Risk is higher when the service can reach internal networks, cloud metadata endpoints, administrative interfaces, or other resources that are not directly accessible to the requester.
Exploit preconditions
- Attack surface: A reachable TensorRT-LLM server endpoint or service feature that can initiate outbound requests
- Required access: Ability to submit or influence request data accepted by that endpoint; authentication requirements depend on deployment configuration
- Trigger point: Server-side processing of attacker-controlled network destinations or request parameters
- Why exploitation is possible: The service may make outbound requests without sufficiently restricting destinations, protocols, or network boundaries
- Attack surface: A reachable TensorRT-LLM server endpoint or service feature that can initiate outbound requests
- Required access: Ability to submit or influence request data accepted by that endpoint; authentication requirements depend on deployment configuration
- Trigger point: Server-side processing of attacker-controlled network destinations or request parameters
- Why exploitation is possible: The service may make outbound requests without sufficiently restricting destinations, protocols, or network boundaries
Why this happens
The underlying issue is insufficient validation and restriction of server-side outbound requests. When externally influenced destinations are accepted by request-handling logic without an effective allowlist, network-layer controls, or equivalent trust-boundary checks, an attacker may redirect the server toward unintended resources. This behavior maps to CWE-918: Server-Side Request Forgery (SSRF).
The underlying issue is insufficient validation and restriction of server-side outbound requests. When externally influenced destinations are accepted by request-handling logic without an effective allowlist, network-layer controls, or equivalent trust-boundary checks, an attacker may redirect the server toward unintended resources. This behavior maps to CWE-918: Server-Side Request Forgery (SSRF).
Potential impact
- Sensitive information accessible from the server's network location may be disclosed
- Internal services or administrative endpoints could be queried
- Cloud or orchestration metadata may be exposed where network access permits
- Network segmentation assumptions could be weakened
- Additional attacks may be enabled through returned response content or observable request behavior
- Sensitive information accessible from the server's network location may be disclosed
- Internal services or administrative endpoints could be queried
- Cloud or orchestration metadata may be exposed where network access permits
- Network segmentation assumptions could be weakened
- Additional attacks may be enabled through returned response content or observable request behavior
General mitigation guidance
Mitigation generally focuses on reducing the server's ability to make arbitrary outbound requests and treating all request destinations as untrusted.
Common defensive patterns include:
- Restricting outbound destinations with explicit host, scheme, port, and IP allowlists
- Blocking private, loopback, link-local, and cloud metadata address ranges unless specifically required
- Validating destinations after DNS resolution and preventing redirect-based allowlist bypasses
- Applying network egress policies and service-level isolation
- Avoiding direct exposure of fetched response content to untrusted callers
- Running the service with least-privilege network and runtime permissions
- Using secure-by-default request clients that disable unsupported protocols and unsafe redirects
Mitigation generally focuses on reducing the server's ability to make arbitrary outbound requests and treating all request destinations as untrusted.
Common defensive patterns include:
- Restricting outbound destinations with explicit host, scheme, port, and IP allowlists
- Blocking private, loopback, link-local, and cloud metadata address ranges unless specifically required
- Validating destinations after DNS resolution and preventing redirect-based allowlist bypasses
- Applying network egress policies and service-level isolation
- Avoiding direct exposure of fetched response content to untrusted callers
- Running the service with least-privilege network and runtime permissions
- Using secure-by-default request clients that disable unsupported protocols and unsafe redirects
How teams detect issues like this
Organizations can look for SSRF risks through:
- Static analysis of code paths that construct outbound requests from user-controlled values
- Code review signals such as unrestricted URL parsing, automatic redirect following, and missing destination validation
- Tests using private, loopback, link-local, and metadata address cases
- Egress firewall and proxy logs showing unexpected requests from TensorRT-LLM services
- Runtime monitoring for unusual DNS resolution, destination changes, or access to internal control-plane endpoints
- Policy enforcement requiring approved outbound destinations for model-serving workloads
Automated security review tools may help identify tainted data flows into network request APIs.
Organizations can look for SSRF risks through:
- Static analysis of code paths that construct outbound requests from user-controlled values
- Code review signals such as unrestricted URL parsing, automatic redirect following, and missing destination validation
- Tests using private, loopback, link-local, and metadata address cases
- Egress firewall and proxy logs showing unexpected requests from TensorRT-LLM services
- Runtime monitoring for unusual DNS resolution, destination changes, or access to internal control-plane endpoints
- Policy enforcement requiring approved outbound destinations for model-serving workloads
Automated security review tools may help identify tainted data flows into network request APIs.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| nvd. | nvd.nist.gov/ |
| cve. | cve.org/ |
