CVE-2026-34753 is a server-side request forgery (SSRF) vulnerability in the vLLM batch runner component of Red Hat AI Inference 3.4.4 (cpu). It allows an attacker who can control batch input JSON to force the server to make arbitrary HTTP/HTTPS requests. This can be exploited to access internal services, including cloud metadata endpoints or internal HTTP APIs, potentially leading to information disclosure or further compromise of the host system. The vulnerability is associated with CWE-918 and related CWEs indicating access control and execution issues. Red Hat has not provided a patch or official fix for this vulnerability as of the advisory date.

The vulnerability allows attackers to bypass access controls by making the vulnerable server act as a proxy to send arbitrary requests to internal services that may not be directly accessible to the attacker. This can lead to information disclosure of sensitive internal data and potentially enable further compromise of the host system. The impact includes confidentiality loss and limited availability impact. No known exploits in the wild have been reported.

Red Hat has not released a patch or official fix for this vulnerability. Mitigation options are either unavailable or do not meet Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is available, consider restricting access to the vulnerable service and controlling input to the batch runner to limit exposure. Engage with Red Hat support or a Technical Account Manager for tailored guidance.