CVE-2026-34753: 
NixOS vulnerability analysis and mitigation

CVE-2026-34753 is a Server-Side Request Forgery (SSRF) vulnerability in the download_bytes_from_url function of vLLM's batch runner (vllm/entrypoints/openai/run_batch.py). It affects vLLM versions 0.16.0 through 0.19.0 (exclusive), allowing any actor who can control batch input JSON to cause the vLLM server to issue arbitrary HTTP/HTTPS requests without URL validation or domain restrictions. The vulnerability was published on April 3, 2026, and patched in version 0.19.0. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause (CWE-918) is the absence of hostname, IP, or domain validation in download_bytes_from_url. The function parses the URL only to dispatch on scheme (data, http, https), then passes the raw attacker-controlled string directly to aiohttp.ClientSession().get(url) with no further checks on hostname, port, path, or redirect targets. The vulnerable data flow begins when an attacker supplies a crafted file_url field in a batch input JSON line (for /v1/audio/transcriptions or /v1/audio/translations endpoints); this value is stored verbatim in BatchTranscriptionRequest or BatchTranslationRequest and passed unchanged into download_bytes_from_url. Notably, the project's multimodal media path (MediaConnector) already implemented an explicit domain allowlist via --allowed-media-domains, but download_bytes_from_url did not reuse that protection (Github Advisory, Fix PR).

Successful exploitation allows an authenticated attacker to pivot the vLLM server into probing internal network services, including cloud instance metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/), internal HTTP APIs, and private-range IP addresses not otherwise accessible from the attacker's position. The primary impact is confidentiality loss through unauthorized access to internal service responses and potential credential or token exposure from cloud metadata services. Availability may also be degraded if the server is forced to make large numbers of outbound requests, and the vulnerability could facilitate lateral movement within cloud or on-premises environments hosting vLLM (Github Advisory, Red Hat Bugzilla).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-34753. The vulnerability requires low privileges — an attacker must be able to supply or influence the batch input JSON file processed by the vLLM batch runner. The EPSS score is approximately 0.034–0.046%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Multiple researchers (Fushuling, L2ncE, TsingShui, l2yyd5, Danthology, iharee, BoyiZhao, Victor-code-Y) were credited as reporters, suggesting coordinated disclosure (Github Advisory).

1. Identify a target vLLM deployment: Confirm the target is running vLLM batch runner (vllm run-batch) with version 0.16.0 ≤ x < 0.19.0 and that you have the ability to supply or modify the batch input JSON file.
2. Craft a malicious batch input JSON line: Construct a JSONL entry targeting the /v1/audio/transcriptions or /v1/audio/translations endpoint with a file_url pointing to an internal resource, for example:

   {"custom_id": "req-1", "method": "POST", "url": "/v1/audio/transcriptions", "body": {"model": "whisper-1", "file_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}

3. Submit the batch file: Provide the crafted JSONL file as the input to the vLLM batch runner (e.g., vllm run-batch --input-file malicious.jsonl ...).
4. Retrieve the response: The batch runner will issue an HTTP GET request to the attacker-controlled URL from the server's network context. The response body (e.g., cloud IAM credentials) will be returned in the batch output, accessible to the attacker.
5. Exploit retrieved data: Use any credentials, tokens, or internal API responses obtained to escalate access within the cloud environment or internal network (Github Advisory, Fix PR).

• Network: Outbound HTTP/HTTPS requests from the vLLM host to cloud metadata endpoints (e.g., 169.254.169.254, fd00:ec2::254) or private IP ranges (10.x.x.x, 192.168.x.x, 172.16-31.x.x, 127.x.x.x) initiated by the vLLM process.
• Network: Unexpected outbound connections to internal hostnames or non-public services from the vLLM server process.
• Logs: vLLM batch runner logs showing download_bytes_from_url fetching URLs with internal IP addresses or cloud metadata hostnames.
• Logs: HTTP access logs on internal services showing requests originating from the vLLM host's IP address with unusual user-agent strings (e.g., aiohttp).
• File System: Batch input JSONL files containing file_url values pointing to http://169.254.169.254/, http://10.x.x.x/, or other internal addresses.

Upgrade vLLM to version 0.19.0 or later, which adds domain allowlist validation to download_bytes_from_url consistent with the existing MediaConnector protection (Github Advisory, Fix Commit). As a configuration-based mitigation on patched versions, explicitly set --allowed-media-domains to a restrictive allowlist of trusted domains when running vllm run-batch, which will cause the batch runner to reject any file_url not matching the allowlist. If upgrading is not immediately possible, restrict access to the vLLM batch runner so that only trusted users can supply batch input files, and apply network-level egress controls to block outbound requests from the vLLM host to internal IP ranges and cloud metadata endpoints.

Red Hat tracked the vulnerability via Bugzilla (Bug 2455394) and assigned it medium severity, with product security team members added to the CC list, indicating active monitoring for downstream impact (Red Hat Bugzilla). The fix was coordinated by vLLM maintainer russellb and implemented by contributor jperezdealgaba, with multiple independent researchers credited as reporters, suggesting the issue was identified through a coordinated security review rather than public exploitation (Github Advisory). No significant broader media coverage or notable social media discussion has been identified for this vulnerability.