CVE-2026-73560 vllm-project CVE debrief

Who should care

Defenders responsible for systems using vLLM, especially those in environments where large language models are deployed, should assess exposure and verify if their systems are using vulnerable versions.

Why it matters

CVE-2026-73560 is a vulnerability in the vLLM inference and serving engine that allows server-side requests and reads of arbitrary files. Defenders should prioritize verifying exposure, especially for systems using vLLM versions prior to 0.26.0, and assess the impact on their systems.

• Potential for server-side requests and reads of arbitrary files accessible to the vLLM process
• Bypass of allowed_media_domains and allowed_local_media_path protections
• Possible impact on confidentiality due to arbitrary file reads

Technical summary

The MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections. This allows server-side requests and reads of arbitrary files accessible to the vLLM process, potentially impacting confidentiality and allowing for arbitrary file reads. The issue is fixed in version 0.26.0, and defenders should prioritize verifying exposure, especially for systems using vLLM versions prior to 0.26.0.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using vLLM versions prior to 0.26.0.

Recommended defensive actions

• Verify if the system uses vLLM versions prior to 0.26.0 and assess exposure
• Implement compensating controls to restrict access to sensitive files and limit server-side requests
• Monitor for potential exploitation attempts and update to version 0.26.0 or later
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but the scope of affected systems and potential impact require further verification. The MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections. This allows server-side requests and reads of arbitrary files accessible to the vLLM process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.