CVE-2026-115917 — vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

2026-10-31T02:08:31.644507+00:00

Affected: vllm-project vllm

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.

GHSA-vvpg-rrww-wpmh — vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

2026-10-31T02:08:31.644599+00:00

Affected: PyPI: vllm

### Summary

The OpenAI-compatible server registers Starlette `CORSMiddleware` with `allowed_origins` defaulting to `["*"]`, and performs no authentication unless `--api-key` (or `VLLM_API_KEY`) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example `localhost` or an internal/VPN address) and read the responses. The default `allow_credentials=False` blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than cookies, the wildcard still permits untokenized access to an unauthenticated server and read access when the caller already holds a token.

### Details

Affected components

- `vllm/entrypoints/launchers/cli_args.py` - `allowed_origins` default value. - `vllm/entrypoints/serve/middleware/register.py` - `CORSMiddleware` registration. - `vllm/entrypoints/serve/middleware/authenticate.py` - auth middleware and its guarded path prefixes.

Root cause

`vllm/entrypoints/launchers/cli_args.py`:

```python allow_credentials: bool = False """Allow credentials.""" allowed_origins: list[str] = field(default_factory=lambda: ["*"]) """Allowed origins.""" ```

`vllm/entrypoints/serve/middleware/register.py`:

```python app.add_middleware( CORSMiddleware, allow_origins=args.allowed_origins, allow_credentials=args.allow_credentials, allow_methods=args.allowed_methods, allow_headers=args.allowed_headers, ) ```

The auth middleware is added only when a…

Most recent entries from all

CVE-2026-115917 — vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

GHSA-vvpg-rrww-wpmh — vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server