Server-Side Request Forgery in vLLM Request Headers

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-116176 is a server-side request forgery (SSRF) vulnerability affecting vLLM versions 0.9.2 through 0.23.x that allows attackers to hijack outbound connections through a malicious X-Request-Id header. By embedding a crafted decode address in this header, threat actors can force the P2pNcclConnector prefill worker to establish ZMQ connections to attacker-controlled infrastructure. This exposes sensitive model data including NCCL unique identifiers and KV-cache tensors, while also enabling denial-of-service through worker blocking. Organizations running vLLM-powered inference services—particularly those processing requests from untrusted sources—face immediate risks of model exfiltration and service disruption.

Casky's 331 mapped skills detect the attack chains underlying this vulnerability by correlating reconnaissance (TA0001) and initial access (TA0006) techniques. Using Claude's extended reasoning, practitioners gain insights into header injection patterns, outbound connection anomalies, and lateral movement indicators. Detection findings would flag suspicious X-Request-Id header values containing network addresses, unexpected ZMQ connection attempts to external hosts, and tensor data access patterns diverging from normal model serving behavior. By mapping to CWE-918 exploitation patterns, Casky enables security teams to identify both direct exploitation attempts and the command-and-control communication channels attackers establish post-compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116176.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-116176

Casky has 331 skills that investigate the attack patterns behind CVE-2026-116176. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn