---
id: "CVE-2026-115917"
kind: "vulnerability"
aliases: ["CVE-2026-115917"]
title: "vLLM: default CORS wildcard lets any web page query local inference servers"
severity: "low"
cvss: 3.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "gpu", "llm-serving", "python", "self-hosted", "vllm"]
not_affected_if: ["auth-required", "managed-hosting", "not-reachable-from-browser"]
published_at: "2026-10-26T18:17:39+00:00"
first_seen_at: "2026-10-26T18:31:43+00:00"
updated_at: "2026-10-26T18:34:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115917", "first_seen_at": "2026-10-26T18:31:43+00:00"}]
---

# vLLM: default CORS wildcard lets any web page query local inference servers

vLLM's OpenAI-compatible server enables Starlette CORS with a wildcard origin by default, so a malicious web page opened in a victim's browser can call an unauthenticated vLLM server on localhost or an internal network. An attacker can list models, run chat completions to consume GPU time, and read the responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show vllm` and see whether it is below `0.32.0`.
- Look for a running OpenAI-compatible server on a reachable address and confirm whether it requires an API key.

## Fix

- Upgrade vLLM to `0.32.0` or later.
- Until upgraded, require bearer authentication on the server or restrict its network access so browsers on other origins cannot reach it.

## Timeline

- 2026-10-26T18:31:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115917

## From the sources

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_