CVE-2026-73560

🗓️ 17 Aug 2026 20:17:25Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

vLLM prior to 0.26.0 allows SSRF and arbitrary file read via _fetch_image bypassing MediaConnector protections.

Reporter	Title	Published	Views	Family All 35
attackerkb	CVE-2026-73560	17 Aug 202620:17	–	attackerkb
Cvelist	CVE-2026-73560 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections	17 Aug 202620:17	–	cvelist
EUVD	EUVD-2026-60377	8 Sep 202620:42	–	euvd
Github Security Blog	vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections	8 Sep 202620:42	–	github
Mend	CVE-2026-73560	17 Aug 202620:17	–	mend
NVD	CVE-2026-73560	17 Aug 202621:16	–	nvd
osv_cga	CGA-2WXX-7GC6-MQWM	9 Sep 202612:17	–	osv_cga
osv_cga	CGA-CF7F-89XQ-JRP8	9 Sep 202614:26	–	osv_cga
osv_cga	CGA-CR6J-3QR5-W5Q5	28 Sep 202617:15	–	osv_cga
osv_cga	CGA-GQW6-X57C-4V8V	9 Sep 202612:59	–	osv_cga

NVD

Vulners

Node

vllm vllmRange<0.26.0

[
  {
    "vendor": "vllm-project",
    "product": "vllm",
    "versions": [
      {
        "version": "< 0.26.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/vllm-project/vllm/commit/54503ecec0f3ac31e5ecfc5f28652e4cc42307b5
github	www.github.com/vllm-project/vllm/security/advisories/GHSA-4hhp-h66f-j5j7
github	www.github.com/vllm-project/vllm/releases/tag/v0.26.0
github	www.github.com/vllm-project/vllm/pull/43117

Parameter	Position	Path	Description	CWE
messages	request body	/v1/chat/completions	The MiMoV2OmniMultiModalProcessor in vLLM fails to validate image and audio URLs/paths provided in the chat completion request, allowing for Server-Side Request Forgery (SSRF) and arbitrary file reads.	CWE-918

28 Sep 2026 18:41Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.5

EPSS0.00407

SSVC

CWE-918