Skip to content
LLMHigh

CVE-2026-73560: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMu…

Occurred
Aug 17, 2026
Published
Aug 17, 2026
Source
NVD CVE

Summary

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.

Tags

  • CVE
  • CVE-2026-73560
  • cvss:MEDIUM

Classification

Category confidence: 95%
Severity confidence: 90%

Rationale: vLLM LLM serving engine vulnerability allows arbitrary file access and SSRF via unvalidated image/audio inputs.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source