An SSRF vulnerability in vLLM versions prior to 0.14.1 allows authenticated attackers to perform unauthorized requests against internal network resources, risking data exposure and service disruption.

The MediaConnector class fails to consistently enforce host name restrictions when processing media from user-provided URLs. By exploiting discrepancies in how different Python parsing libraries interpret backslashes, an authenticated attacker can coerce the vLLM server into making arbitrary requests to internal network segments.

Successful exploitation allows an attacker to interact with internal services that are otherwise protected from the public internet. This can lead to the exfiltration of sensitive data, unauthorized interaction with containerized management endpoints, or denial of service through manipulation of system metrics. With a CVSS score of 7.1, this vulnerability represents a significant risk to the integrity and availability of the internal infrastructure hosting the LLM engine.

Immediate Action: Update the vLLM package to version 0.14.1 or later immediately to incorporate the necessary input validation fixes in the MediaConnector class.

Proactive Monitoring: Review application access logs for unusual outbound request patterns originating from the vLLM service, particularly those targeting internal IP addresses or sensitive management ports.

Compensating Controls: Implement strict egress filtering on the network segment where vLLM containers are deployed to prevent the service from reaching unauthorized internal network resources.

Public Exploit Available: Unknown.

Given the potential for lateral movement within containerized environments, organizations should prioritize upgrading vLLM to version 0.14.1. Patching is the only effective way to remediate the underlying parsing discrepancy, and administrators should ensure that network security policies are configured to follow the principle of least privilege for all LLM inference workloads.