vLLM: MiMo-V2-Omni processor bypasses media allowlists, enabling SSRF and local file reads

Impact

The MiMo-V2-Omni multimodal processor hands attacker-supplied image and audio strings straight to _fetch_image, requests.get and Image.open instead of routing them through MediaConnector. That skips allowed_media_domains and allowed_local_media_path — precisely the two controls an operator sets so a shared inference endpoint cannot be used as a fetch proxy. The server will therefore request arbitrary URLs and open arbitrary files readable by the vLLM process: cloud instance-metadata endpoints, control-plane and management APIs reachable from the GPU node's network position, and whatever is mounted into the serving container, including credentials and model artifacts. Confidentiality only per the scored vector, and only deployments actually serving a model that uses this processor are exposed.

Who can reach it

Any client that can submit a request with image or audio inputs to a vLLM server loading a MiMo-V2-Omni model. The scored vector records PR:L, so an API credential where the deployment enforces one; endpoints fronted by an unauthenticated internal gateway need none. The attacker fully controls the URL or path.

What to do

Upgrade to vLLM 0.26.0 or later and restart the serving processes; every version before 0.26.0 is affected. If you cannot upgrade immediately, stop serving MiMo-V2-Omni models — the bypass is specific to that processor. Because SSRF was possible, also check whether the node's metadata endpoint or internal APIs could have been reached and rotate any credential exposed to the vLLM container. Rolling restart only; no node drain or reboot.

References