vLLM: attacker-supplied X-Request-Id makes a prefill worker ZMQ-connect out, leaking NCCL id and KV cache

Impact

A caller of the inference API controls where a disaggregated-prefill worker opens an outbound ZMQ connection by putting a decode address in the X-Request-Id header. The worker then hands the attacker host the NCCL unique_id and KV-cache tensors for in-flight requests, so prompt and generated content belonging to other callers leaks off the node, and the NCCL id is enough to join the collective the serving group uses. The same primitive points the worker at a host that never answers, parking the prefill stage and stalling the serving group. On a shared GPU fleet this is a cross-tenant disclosure path that leaves the GPUs resident and busy, and it reaches outbound from inside the cluster network, so egress-restricted nodes are only partly protected.

Who can reach it

Anyone who can send an HTTP request to the vLLM API server, including through a gateway that forwards client headers. No authentication is needed beyond whatever fronts the endpoint, and only deployments using the P2pNcclConnector for prefill/decode disaggregation are affected.

What to do

Upgrade vLLM to 0.24.0 or later and restart the API server and every prefill/decode worker - a rolling restart per replica, no node reboot. Until then, strip or overwrite X-Request-Id at the ingress in front of vLLM, and confirm the serving namespace cannot open arbitrary outbound TCP connections.

References

Related entries

• OpenShift AI dashboard: incorrect network binding lets an in-cluster actor impersonate any user with an arbitrary tokenCVE-2026-16745 · Red Hat OpenShift AI odh-dashboard (network binding / token handling)High
• Langflow: incomplete filtering of Docker volume and device arguments exposes host files from a flowCVE-2026-17626 · IBM Langflow OSS (Docker-based MCP server argument filtering)High
• OpenShift AI training-operator: namespace edit/admin users escalate to host filesystem access via crafted training jobsCVE-2026-18982 · Red Hat OpenShift AI training-operator (ClusterRole aggregation + PodTemplateSpec passthrough)High
• vLLM (HF `auto_map`): Loads Hugging Face dynamic modules during model resolutionCVE-2026-22807 · vLLM (HF `auto_map`)High
• PyTorch (`weights_only` unpickler): Bypass of the `weights_only` allowlistCVE-2026-24747 · PyTorch (`weights_only` unpickler)High
• vLLM (hardcoded `trust_remote_code`, second instance): Same class, two more model files, through 0.18.0CVE-2026-27893 · vLLM (hardcoded `trust_remote_code`, second instance)High