{"schema":"threatline.record/2","record":{"id":"GHSA-vfp2-c8pq-v6h6","aliases":["GHSA-vfp2-c8pq-v6h6"],"summary":"SSRF via X-Request-Id header drives P2pNcclConnector outbound ZMQ+NCCL pair, leaking KV-cache tensors","details":"**Summary**\n\n`OpenAIServing._base_request_id` copies the HTTP `X-Request-Id` header verbatim into the `request_id` used throughout the vLLM engine, and `P2pNcclConnector.parse_request_id` extracts an arbitrary `host:port` from that value via a permissive regex with no allow-list or scheme check. An API caller can embed a routing token in `X-Request-Id` to force a prefill worker running with `P2pNcclConnector` to ZMQ-DEALER-connect outbound to an attacker-controlled host, share the NCCL communicator unique_id over that channel, and ultimately `ncclSend` the KV-cache tensors of the targeted request to the attacker. The affected V1 connector is present in vLLM `>= 0.9.2, < 0.24.0`.\n\n**Details**\n\n`vllm/entrypoints/openai/engine/serving.py:399` (`OpenAIServing._base_request_id`) returns `raw_request.headers.get(\"X-Request-Id\")` verbatim, so the user-controlled header value becomes the base `request_id` for any `/v1/completions` or `/v1/chat/completions` request. `vllm/distributed/kv_transfer/kv_connector/v1/p2p/p2p_nccl_connector.py:450` (`parse_request_id`) then applies the regex `r\"___decode_addr_(.*):(\\d+)\"` with no allow-list, scheme check, or IP-literal block to extract `ip` and `port`.\n\n`vllm/distributed/kv_transfer/kv_connector/v1/p2p/p2p_nccl_engine.py:207` (`create_connect`) calls `sock.connect(f\"tcp://{remote_address}\")` and immediately sends `msgpack.dumps({\"cmd\": \"NEW\", \"unique_id\": bytes(unique_id.internal)})` before calling `ncclCommInitRank`, and at line 533 `send_sync` dispatches the KV cache via `ncclSend` over that communicator — both steps execute against whatever host the attacker named.\n\nRequires `--kv-transfer-config '{\"kv_connector\":\"P2pNcclConnector\",\"kv_role\":\"kv_producer\",...}'`; no additional privileges beyond a valid API key (or no key if `--api-key` is unset).\n\n**Affected versions and remediation**\n\n- Package: `vllm` (PyPI).\n- Affected versions: `>= 0.9.2, < 0.24.0`, when using `P2pNcclConnector`.\n- Patched version: `0.24.0`.\n- PR [#44854](https://github.com/vllm-project/vllm/pull/44854) removed the affected connector and its registration.\n\n**Impact**\n\nAny API client that can reach a prefill worker running `P2pNcclConnector` can exfiltrate the full KV-cache (prompt text and prefix-cached hidden states) of any request that worker processes, using only an HTTP header. The leak also includes the NCCL communicator unique_id, and the blocking `ncclCommInitRank` call against an unresponsive attacker host constitutes a denial-of-service vector against the prefill worker. CWE-918 (Server-Side Request Forgery), severity high.\n\n**Fix**\n\n`OpenAIServing._base_request_id` in `vllm/entrypoints/openai/engine/serving.py` must strip or replace `X-Request-Id` with a random UUID when `P2pNcclConnector` is active, preventing any user-supplied value from reaching `parse_request_id`. Additionally, `create_connect` in `vllm/distributed/kv_transfer/kv_connector/v1/p2p/p2p_nccl_engine.py` must validate `remote_address` against an operator-configured CIDR/hostname allow-list (supplied via `kv_connector_extra_config`) before opening the ZMQ socket and initiating NCCL bootstrap.","categories":["Unclassified"],"product":"vllm","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6","source_modified_at":"2026-10-09T07:58:04Z","fetched_at":"2026-10-26T06:00:26.954813Z","package":{"ecosystem":"pip","name":"vllm"},"range":">= 0.9.2, < 0.24.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6","source_modified_at":"2026-10-09T07:58:04Z","fetched_at":"2026-10-26T06:00:26.954813Z","package":{"ecosystem":"pip","name":"vllm"},"version":"0.24.0"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-09T07:58:03Z","modified_at":"2026-10-09T07:58:04Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6","fetched_at":"2026-10-26T06:00:26.954813Z","source_modified_at":"2026-10-09T07:58:04Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T07:58:04Z","content_hash":"5a34de482c4865634767e943dca49bb0a79fc7e2e9e4a8fca9b72d7ffcf184f0"}}