{"id":"CVE-2026-115917","kind":"vulnerability","aliases":["CVE-2026-115917"],"related":[],"title":"vLLM: default CORS wildcard lets any web page query local inference servers","description":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.","summary":"vLLM's OpenAI-compatible server enables Starlette CORS with a wildcard origin by default, so a malicious web page opened in a victim's browser can call an unauthenticated vLLM server on localhost or an internal network. An attacker can list models, run chat completions to consume GPU time, and read the responses.","severity":"low","cvss":3.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gpu","llm-serving","python","self-hosted","vllm"],"not_affected_if":["auth-required","managed-hosting","not-reachable-from-browser"],"how_to_check":"- Check the installed version with `pip show vllm` and see whether it is below `0.32.0`.\n- Look for a running OpenAI-compatible server on a reachable address and confirm whether it requires an API key.","fix":"- Upgrade vLLM to `0.32.0` or later.\n- Until upgraded, require bearer authentication on the server or restrict its network access so browsers on other origins cannot reach it.","status":"open","published_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:34:20+00:00","updated_at":"2026-10-26T18:34:20+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T18:34:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.32.0` or later.\n- Until upgraded, require bearer authentication on the server or restrict its network access so browsers on other origins cannot reach it.","reach":"network","title":"vLLM: default CORS wildcard lets any web page query local inference servers","impact":"low","summary":"vLLM's OpenAI-compatible server enables Starlette CORS with a wildcard origin by default, so a malicious web page opened in a victim's browser can call an unauthenticated vLLM server on localhost or an internal network. An attacker can list models, run chat completions to consume GPU time, and read the responses.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","gpu","llm-serving"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs model inference on the victim's GPU and reads responses","analyst_note":"","how_to_check":"- Check the installed version with `pip show vllm` and see whether it is below `0.32.0`.\n- Look for a running OpenAI-compatible server on a reachable address and confirm whether it requires an API key.","needs_analyst":false,"not_affected_if":["auth-required","managed-hosting","not-reachable-from-browser"],"who_is_affected":"Teams that run vLLM's OpenAI-compatible server without authentication on a laptop, workstation, or internal network that a browser user can reach. Deployments that require a bearer token are exposed only when the attacker already has a usable token. Hosted or managed endpoints that are not reachable from a victim's browser are unlikely to be affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000639,"input_tokens":3425,"output_tokens":593,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115917':15A,18A '-2026':14A,17A '/v1/chat/completions':147C '/v1/models':144C '0.32.0':98C,193C 'ai':20B 'ai-tool':19B 'allow':108C 'alreadi':182C 'appli':164C 'attack':70B 'authent':175C 'base':156C 'bearer':174C 'browser':56B,125C 'call':58B,140C 'caller':181C 'chat':75B 'compat':35B,102C 'complet':76B 'configur':104C 'consum':78B,148C 'cooki':155C 'cookie-bas':154C 'cor':3A,39B 'corsmiddlewar':106C 'credenti':166C 'cross':158C 'cross-sit':157C 'cve':13A,16A 'default':2A,45B,115C,170C 'deploy':172C 'disabl':168C 'enabl':37B 'endpoint':141C 'engin':91C 'expos':177C 'fix':190C 'forgeri':161C 'get':143C 'gpu':22B,79B,149C 'host':29B 'includ':142C 'infer':11A,88C 'intern':67B,135C 'issu':188C 'languag':94C 'larg':93C 'let':5A 'list':72B 'llm':24B 'llm-serv':23B 'local':10A 'localhost':64B,133C 'malici':48B,117C 'model':73B,95C 'network':68B,136C 'open':51B 'openai':34B,101C 'openai-compat':33B,100C 'origin':43B,109C 'page':8A,50B,119C 'post':146C 'prior':96C 'python':26B 'queri':9A 'reach':127C 'read':82B,152C 'request':160C 'requir':173C 'resourc':150C 'respons':84B,153C 'run':74B 'self':28B 'self-host':27B 'serv':25B,90C 'server':12A,36B,62B,103C,131C 'set':110C 'site':159C 'starlett':38B,105C 'time':80B 'token':186C 'tool':21B 'unauthent':60B,129C 'usabl':185C 'use':121C 'version':192C 'victim':54B,123C 'vllm':1A,30B,31B,61B,85C,130C 'vpn':139C 'web':7A,49B,118C 'wildcard':4A,42B,113C","nicknames":[],"mitigations":[],"who_affected":"Teams that run vLLM's OpenAI-compatible server without authentication on a laptop, workstation, or internal network that a browser user can reach. Deployments that require a bearer token are exposed only when the attacker already has a usable token. Hosted or managed endpoints that are not reachable from a victim's browser are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115917","severity":null,"published_at":"2026-10-26T18:17:39+00:00","modified_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}