CVE-2026-22778 vLLM Malicious Video URL Submission to Multimodal Endpoint

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•7

This rule detects two stages of a potential exploitation chain targeting vLLM multimodal endpoints. Stage 1 identifies POST requests to vLLM API endpoints that contain 'video_url' in the request context, which could indicate an attempt to exploit CVE-2026-22778. Stage 2 detects post-exploitation activity by looking for unexpected child processes (like shell interpreters or download utilities) spawned from vLLM or Python inference processes, suggesting successful remote code execution.