Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-73560

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 35.4%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-73560
  • Vllm » Vllm » Version: 0.1.0
    cpe:2.3:a:vllm:vllm:0.1.0
  • Vllm » Vllm » Version: 0.1.1
    cpe:2.3:a:vllm:vllm:0.1.1
  • Vllm » Vllm » Version: 0.1.2
    cpe:2.3:a:vllm:vllm:0.1.2
  • Vllm » Vllm » Version: 0.1.3
    cpe:2.3:a:vllm:vllm:0.1.3
  • Vllm » Vllm » Version: 0.1.4
    cpe:2.3:a:vllm:vllm:0.1.4
  • Vllm » Vllm » Version: 0.1.5
    cpe:2.3:a:vllm:vllm:0.1.5
  • Vllm » Vllm » Version: 0.1.6
    cpe:2.3:a:vllm:vllm:0.1.6
  • Vllm » Vllm » Version: 0.1.7
    cpe:2.3:a:vllm:vllm:0.1.7
  • Vllm » Vllm » Version: 0.10.0
    cpe:2.3:a:vllm:vllm:0.10.0
  • Vllm » Vllm » Version: 0.10.1
    cpe:2.3:a:vllm:vllm:0.10.1
  • Vllm » Vllm » Version: 0.10.1.1
    cpe:2.3:a:vllm:vllm:0.10.1.1
  • Vllm » Vllm » Version: 0.10.2
    cpe:2.3:a:vllm:vllm:0.10.2
  • Vllm » Vllm » Version: 0.11.0
    cpe:2.3:a:vllm:vllm:0.11.0
  • Vllm » Vllm » Version: 0.11.1
    cpe:2.3:a:vllm:vllm:0.11.1
  • Vllm » Vllm » Version: 0.11.2
    cpe:2.3:a:vllm:vllm:0.11.2
  • Vllm » Vllm » Version: 0.12.0
    cpe:2.3:a:vllm:vllm:0.12.0
  • Vllm » Vllm » Version: 0.13.0
    cpe:2.3:a:vllm:vllm:0.13.0
  • Vllm » Vllm » Version: 0.14.0
    cpe:2.3:a:vllm:vllm:0.14.0
  • Vllm » Vllm » Version: 0.14.1
    cpe:2.3:a:vllm:vllm:0.14.1
  • Vllm » Vllm » Version: 0.15.0
    cpe:2.3:a:vllm:vllm:0.15.0
  • Vllm » Vllm » Version: 0.15.1
    cpe:2.3:a:vllm:vllm:0.15.1
  • Vllm » Vllm » Version: 0.15.2
    cpe:2.3:a:vllm:vllm:0.15.2
  • Vllm » Vllm » Version: 0.16.0
    cpe:2.3:a:vllm:vllm:0.16.0
  • Vllm » Vllm » Version: 0.16.1
    cpe:2.3:a:vllm:vllm:0.16.1
  • Vllm » Vllm » Version: 0.17.0
    cpe:2.3:a:vllm:vllm:0.17.0
  • Vllm » Vllm » Version: 0.17.1
    cpe:2.3:a:vllm:vllm:0.17.1
  • Vllm » Vllm » Version: 0.17.2
    cpe:2.3:a:vllm:vllm:0.17.2
  • Vllm » Vllm » Version: 0.18.0
    cpe:2.3:a:vllm:vllm:0.18.0
  • Vllm » Vllm » Version: 0.18.1
    cpe:2.3:a:vllm:vllm:0.18.1
  • Vllm » Vllm » Version: 0.18.2
    cpe:2.3:a:vllm:vllm:0.18.2
  • Vllm » Vllm » Version: 0.19.0
    cpe:2.3:a:vllm:vllm:0.19.0
  • Vllm » Vllm » Version: 0.19.1
    cpe:2.3:a:vllm:vllm:0.19.1
  • Vllm » Vllm » Version: 0.19.2
    cpe:2.3:a:vllm:vllm:0.19.2
  • Vllm » Vllm » Version: 0.2.0
    cpe:2.3:a:vllm:vllm:0.2.0
  • Vllm » Vllm » Version: 0.2.1
    cpe:2.3:a:vllm:vllm:0.2.1
  • Vllm » Vllm » Version: 0.2.2
    cpe:2.3:a:vllm:vllm:0.2.2
  • Vllm » Vllm » Version: 0.2.3
    cpe:2.3:a:vllm:vllm:0.2.3
  • Vllm » Vllm » Version: 0.2.4
    cpe:2.3:a:vllm:vllm:0.2.4
  • Vllm » Vllm » Version: 0.2.5
    cpe:2.3:a:vllm:vllm:0.2.5
  • Vllm » Vllm » Version: 0.2.6
    cpe:2.3:a:vllm:vllm:0.2.6
  • Vllm » Vllm » Version: 0.2.7
    cpe:2.3:a:vllm:vllm:0.2.7
  • Vllm » Vllm » Version: 0.20.0
    cpe:2.3:a:vllm:vllm:0.20.0
  • Vllm » Vllm » Version: 0.20.1
    cpe:2.3:a:vllm:vllm:0.20.1
  • Vllm » Vllm » Version: 0.20.2
    cpe:2.3:a:vllm:vllm:0.20.2
  • Vllm » Vllm » Version: 0.21.0
    cpe:2.3:a:vllm:vllm:0.21.0
  • Vllm » Vllm » Version: 0.21.1
    cpe:2.3:a:vllm:vllm:0.21.1
  • Vllm » Vllm » Version: 0.22.0
    cpe:2.3:a:vllm:vllm:0.22.0
  • Vllm » Vllm » Version: 0.22.1
    cpe:2.3:a:vllm:vllm:0.22.1
  • Vllm » Vllm » Version: 0.23.0
    cpe:2.3:a:vllm:vllm:0.23.0
  • Vllm » Vllm » Version: 0.23.1
    cpe:2.3:a:vllm:vllm:0.23.1
  • Vllm » Vllm » Version: 0.24.0
    cpe:2.3:a:vllm:vllm:0.24.0
  • Vllm » Vllm » Version: 0.25.0
    cpe:2.3:a:vllm:vllm:0.25.0
  • Vllm » Vllm » Version: 0.25.1
    cpe:2.3:a:vllm:vllm:0.25.1
  • Vllm » Vllm » Version: 0.3.0
    cpe:2.3:a:vllm:vllm:0.3.0
  • Vllm » Vllm » Version: 0.3.1
    cpe:2.3:a:vllm:vllm:0.3.1
  • Vllm » Vllm » Version: 0.3.2
    cpe:2.3:a:vllm:vllm:0.3.2
  • Vllm » Vllm » Version: 0.3.3
    cpe:2.3:a:vllm:vllm:0.3.3
  • Vllm » Vllm » Version: 0.4.0
    cpe:2.3:a:vllm:vllm:0.4.0
  • Vllm » Vllm » Version: 0.4.1
    cpe:2.3:a:vllm:vllm:0.4.1
  • Vllm » Vllm » Version: 0.4.2
    cpe:2.3:a:vllm:vllm:0.4.2
  • Vllm » Vllm » Version: 0.4.3
    cpe:2.3:a:vllm:vllm:0.4.3
  • Vllm » Vllm » Version: 0.5.0
    cpe:2.3:a:vllm:vllm:0.5.0
  • Vllm » Vllm » Version: 0.5.1
    cpe:2.3:a:vllm:vllm:0.5.1
  • Vllm » Vllm » Version: 0.5.2
    cpe:2.3:a:vllm:vllm:0.5.2
  • Vllm » Vllm » Version: 0.5.3
    cpe:2.3:a:vllm:vllm:0.5.3
  • Vllm » Vllm » Version: 0.5.4
    cpe:2.3:a:vllm:vllm:0.5.4
  • Vllm » Vllm » Version: 0.5.5
    cpe:2.3:a:vllm:vllm:0.5.5
  • Vllm » Vllm » Version: 0.6.0
    cpe:2.3:a:vllm:vllm:0.6.0
  • Vllm » Vllm » Version: 0.6.1
    cpe:2.3:a:vllm:vllm:0.6.1
  • Vllm » Vllm » Version: 0.6.2
    cpe:2.3:a:vllm:vllm:0.6.2
  • Vllm » Vllm » Version: 0.6.3
    cpe:2.3:a:vllm:vllm:0.6.3
  • Vllm » Vllm » Version: 0.6.4
    cpe:2.3:a:vllm:vllm:0.6.4
  • Vllm » Vllm » Version: 0.6.5
    cpe:2.3:a:vllm:vllm:0.6.5
  • Vllm » Vllm » Version: 0.6.6
    cpe:2.3:a:vllm:vllm:0.6.6
  • Vllm » Vllm » Version: 0.7.0
    cpe:2.3:a:vllm:vllm:0.7.0
  • Vllm » Vllm » Version: 0.7.1
    cpe:2.3:a:vllm:vllm:0.7.1
  • Vllm » Vllm » Version: 0.7.2
    cpe:2.3:a:vllm:vllm:0.7.2
  • Vllm » Vllm » Version: 0.7.3
    cpe:2.3:a:vllm:vllm:0.7.3
  • Vllm » Vllm » Version: 0.8.0
    cpe:2.3:a:vllm:vllm:0.8.0
  • Vllm » Vllm » Version: 0.8.1
    cpe:2.3:a:vllm:vllm:0.8.1
  • Vllm » Vllm » Version: 0.8.2
    cpe:2.3:a:vllm:vllm:0.8.2
  • Vllm » Vllm » Version: 0.8.3
    cpe:2.3:a:vllm:vllm:0.8.3
  • Vllm » Vllm » Version: 0.8.4
    cpe:2.3:a:vllm:vllm:0.8.4
  • Vllm » Vllm » Version: 0.8.5
    cpe:2.3:a:vllm:vllm:0.8.5
  • Vllm » Vllm » Version: 0.9.0
    cpe:2.3:a:vllm:vllm:0.9.0
  • Vllm » Vllm » Version: 0.9.0.1
    cpe:2.3:a:vllm:vllm:0.9.0.1
  • Vllm » Vllm » Version: 0.9.1
    cpe:2.3:a:vllm:vllm:0.9.1
  • Vllm » Vllm » Version: 0.9.2
    cpe:2.3:a:vllm:vllm:0.9.2


Products
Pricing
Contact Us

Shodan ® - All rights reserved