GHSA-VVPG-RRWW-WPMH

Vulnerability from github – Published: 2026-10-28 21:15 – Updated: 2026-10-28 21:15
VLAI
Summary
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
Details

Summary

The OpenAI-compatible server registers Starlette CORSMiddleware with allowed_origins defaulting to ["*"], and performs no authentication unless --api-key (or VLLM_API_KEY) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example localhost or an internal/VPN address) and read the responses. The default allow_credentials=False blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than cookies, the wildcard still permits untokenized access to an unauthenticated server and read access when the caller already holds a token.

Details

Affected components

  • vllm/entrypoints/launchers/cli_args.py - allowed_origins default value.
  • vllm/entrypoints/serve/middleware/register.py - CORSMiddleware registration.
  • vllm/entrypoints/serve/middleware/authenticate.py - auth middleware and its guarded path prefixes.

Root cause

vllm/entrypoints/launchers/cli_args.py:

allow_credentials: bool = False
"""Allow credentials."""
allowed_origins: list[str] = field(default_factory=lambda: ["*"])
"""Allowed origins."""

vllm/entrypoints/serve/middleware/register.py:

app.add_middleware(
    CORSMiddleware,
    allow_origins=args.allowed_origins,
    allow_credentials=args.allow_credentials,
    allow_methods=args.allowed_methods,
    allow_headers=args.allowed_headers,
)

The auth middleware is added only when a token is configured and guards only the /v1, /v2, /inference, and /cohere prefixes. /v1/load_lora_adapter and /v1/unload_lora_adapter are inside /v1 and therefore do require a key when one is set; they are open only when no key is configured and dynamic LoRA updating is enabled.

Impact

  • A malicious page can enumerate models (GET /v1/models), issue POST /v1/chat/completions, consume GPU time, and read model output through the victim's browser.
  • When the server is reachable only from the victim's network, the browser acts as a proxy a remote website could not otherwise use.
  • With allow_credentials=False, cookie-based CSRF does not apply; the exposure is cross-origin request execution and response disclosure.

This advisory was fixed in MR61009.

Severity
3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-115917"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-28T21:15:49Z",
    "nvd_published_at": "2026-10-26T18:17:39Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nThe OpenAI-compatible server registers Starlette `CORSMiddleware` with\n`allowed_origins` defaulting to `[\"*\"]`, and performs no authentication unless\n`--api-key` (or `VLLM_API_KEY`) is configured. A web page on any origin can send\nrequests to a vLLM server that the victim\u0027s browser can reach (for example\n`localhost` or an internal/VPN address) and read the responses. The default\n`allow_credentials=False` blocks cookie-bearing cross-origin requests; because\nvLLM authenticates with a bearer header rather than cookies, the wildcard still\npermits untokenized access to an unauthenticated server and read access when the\ncaller already holds a token.\n\n### Details\n\nAffected components\n\n- `vllm/entrypoints/launchers/cli_args.py` - `allowed_origins` default value.\n- `vllm/entrypoints/serve/middleware/register.py` - `CORSMiddleware`\n  registration.\n- `vllm/entrypoints/serve/middleware/authenticate.py` - auth middleware and its\n  guarded path prefixes.\n\n Root cause\n\n`vllm/entrypoints/launchers/cli_args.py`:\n\n```python\nallow_credentials: bool = False\n\"\"\"Allow credentials.\"\"\"\nallowed_origins: list[str] = field(default_factory=lambda: [\"*\"])\n\"\"\"Allowed origins.\"\"\"\n```\n\n`vllm/entrypoints/serve/middleware/register.py`:\n\n```python\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=args.allowed_origins,\n    allow_credentials=args.allow_credentials,\n    allow_methods=args.allowed_methods,\n    allow_headers=args.allowed_headers,\n)\n```\n\nThe auth middleware is added only when a token is configured and guards only the\n`/v1`, `/v2`, `/inference`, and `/cohere` prefixes. `/v1/load_lora_adapter` and\n`/v1/unload_lora_adapter` are inside `/v1` and therefore do require a key when\none is set; they are open only when no key is configured and dynamic LoRA\nupdating is enabled.\n\n### Impact\n\n\n- A malicious page can enumerate models (`GET /v1/models`), issue\n  `POST /v1/chat/completions`, consume GPU time, and read model output through\n  the victim\u0027s browser.\n- When the server is reachable only from the victim\u0027s network, the browser acts\n  as a proxy a remote website could not otherwise use.\n- With `allow_credentials=False`, cookie-based CSRF does not apply; the exposure\n  is cross-origin request execution and response disclosure.\n\nThis advisory was fixed in [MR61009](https://github.com/vllm-project/vllm/pull/61009).",
  "id": "GHSA-vvpg-rrww-wpmh",
  "modified": "2026-10-28T21:15:50Z",
  "published": "2026-10-28T21:15:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115917"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/61009"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/releases/tag/v0.32.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.