vLLM MediaConnector SSRF to Internal Endpoint

How the attack works

An attacker submits a request to a public-facing vLLM inference server that includes a URL for the model to load as media input. The server's MediaConnector component fetches that URL server-side, but the URL points to an internal, loopback, link-local, or cluster-internal address instead of legitimate external media. This can happen once, or as a fan-out across multiple internal endpoints, sometimes preceded by a normal external media fetch to establish cover. If the target is a sensitive endpoint such as a cloud metadata IP, the Kubernetes API, or a management path like /actuator or /admin, the attacker may be trying to extract credentials or control-plane access.

Netzilo detection

Why it matters

A successful SSRF here lets an outsider use the AI server's network position to reach internal services it should never touch, potentially exposing cloud credentials, container orchestration APIs, or other internal systems that are not meant to be internet-reachable.

What you can do

• →Restrict outbound network access from the inference server process so it cannot reach cloud metadata IPs, the Kubernetes API, or other internal management endpoints.
• →Validate and allow-list media URL schemes/hosts before the server fetches them, rejecting internal, loopback, and link-local address ranges.
• →Run the inference server in a network segment or namespace with egress policies that block access to sensitive internal services by default.
• →Review logs for inference server requests that trigger outbound fetches to unexpected internal addresses, especially those preceded by external media URLs from the same session.

Known benign look-alikes

• Distributed vLLM or Ray multi-node serving where the API server legitimately calls sibling pods on 10.0.0.0/8 or *.svc.cluster.local (mitigated by requiring a sensitive target, wide fan-out, or an external precursor fetch within a 120s window).
• Sidecar or service-mesh health and metric scraping performed outbound by the inference container itself (single fixed endpoint scores 0 and does not fire).
• Internal MinIO / S3-compatible object store or an internal image CDN on a private address serving legitimate multimodal media inputs.
• Local development running vLLM against localhost test fixtures and a local mock media server (will fire only if three or more distinct localhost endpoints are hit in 120s).
• Internal model registry or tokenizer mirror on a .internal / .corp hostname fetched at server start-up.

References

• https://github.com/vllm-project/vllm
• https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
• https://attack.mitre.org/techniques/T1190/
• https://attack.mitre.org/techniques/T1046/

Related threats