What happened
The U.S. National Vulnerability Database published CVE-2026-116176 on October 25, 2026, covering a server-side request forgery in the vLLM inference engine from 0.9.2 up to 0.24.0. The vLLM project's advisory (GHSA-vfp2-c8pq-v6h6, first published October 9) says the X-Request-Id header is copied into the internal request ID, so a caller can embed an address that makes a prefill worker running the P2pNcclConnector connect to an attacker's server and send it the KV cache of requests it processes, which contains prompt data. Only deployments using that connector for disaggregated prefill are affected; vLLM 0.24.0 removes the connector. (vLLM security advisory GHSA-vfp2-c8pq-v6h6, Oct. 9, 2026)
Note on figures: The CVSS 8.8 score is from the NVD record; the vLLM advisory rates it high. Neither source reports exploitation in the wild.
What it means for Canada: our assessment
Assessment: no Canadian victims are reported. Canadian AI startups, research labs, cloud and sovereign-compute providers, and enterprises self-hosting models on vLLM are exposed only if they run the P2pNcclConnector, but those that do could leak customer prompts containing personal information.
- Sectors
- AI startups and model-hosting providers · University and research AI compute · Banks, insurers and health organizations self-hosting LLMs · Cloud and sovereign AI compute providers
- Tools involved
- vLLM 0.9.2 to 0.23.x with P2pNcclConnector · OpenAI-compatible vLLM API endpoints (/v1/completions, /v1/chat/completions)
- Canadian rules
- PIPEDA: leaked prompts containing personal information can be a breach that must be reported to the Privacy Commissioner if there is a real risk of significant harm
Quebec Law 25: confidentiality incidents must be recorded and serious ones reported to the Commission d'accès à l'information
Provincial health privacy laws such as Ontario's PHIPA apply where clinical notes or patient data pass through self-hosted models
OSFI B-13 and E-23: federally regulated financial institutions must manage technology risk and the risk of models they deploy, including self-hosted LLM infrastructure
Assessment, not documented exposure. vLLM is a widely used open-source engine for self-hosting models, including by organizations that keep inference in Canada for data-residency reasons. The flaw needs only API access (or none if no API key is set), so any Canadian deployment using the affected connector would expose prompts from every user of that worker.
Takeaways for Canadian businesses
- BusinessUpgrade vLLM to 0.24.0 or later on every inference node, as the vLLM advisory GHSA-vfp2-c8pq-v6h6 directs.
- BusinessUntil you upgrade, check your launch flags for --kv-transfer-config with "kv_connector":"P2pNcclConnector" and switch that worker off or to another connector if it is present.
- BusinessAlways start vLLM with --api-key set and keep the OpenAI-compatible API off the public internet; the advisory says an unset key lets anyone exploit the flaw.
- BusinessBlock outbound connections from prefill and decode workers to anything outside your cluster, so a forced ZMQ connection to an outside host fails.
- BusinessIf logs show X-Request-Id values containing ___decode_addr_ with an unknown host, treat it as a possible leak of prompt data and assess your PIPEDA or Law 25 breach-reporting duties.
For the Canadian AI sector
Self-hosting is a common way Canadian firms keep sensitive data in-country, but it moves patching of inference software onto them. This flaw shows that performance features in inference stacks can leak prompt data between tenants.
Written by AgentsNorth from the source below. General information, not legal or security advice.