Live › vulnerability › CVE-2026-115917
Go to dashboardvLLM's OpenAI-compatible server enables Starlette CORS with a wildcard origin by default, so a malicious web page opened in a victim's browser can call an unauthenticated vLLM server on localhost or an internal network. An attacker can list models, run chat completions to consume GPU time, and read the responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams that run vLLM's OpenAI-compatible server without authentication on a laptop, workstation, or internal network that a browser user can reach. Deployments that require a bearer token are exposed only when the attacker already has a usable token. Hosted or managed endpoints that are not reachable from a victim's browser are unlikely to be affected.
No product ranges from the sources yet.
pip show vllm and see whether it is below 0.32.0.0.32.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115917")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.