CVE-2026-116176 | vllm-project vLLM up to 0.23.x P2pNcclConnector prefill worker X-Request-Id server-side request forgery

October 25, 2026 Yanac

A vulnerability identified as critical has been detected in vllm-project vLLM up to 0.23.x. Affected by this vulnerability is an unknown functionality of the component P2pNcclConnector prefill worker. The manipulation of the argument X-Request-Id leads to server-side request forgery.

This vulnerability is traded as CVE-2026-116176. It is possible to initiate the attack remotely. There is no exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More