{"id":"CVE-2026-115917","aliases":["GHSA-vvpg-rrww-wpmh"],"url":"https://o3.security/vulnerability/CVE-2026-115917","summary":"vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server","details":"### Summary\n\nThe OpenAI-compatible server registers Starlette `CORSMiddleware` with\n`allowed_origins` defaulting to `[\"*\"]`, and performs no authentication unless\n`--api-key` (or `VLLM_API_KEY`) is configured. A web page on any origin can send\nrequests to a vLLM server that the victim's browser can reach (for example\n`localhost` or an internal/VPN address) and read the responses. The default\n`allow_credentials=False` blocks cookie-bearing cross-origin requests; because\nvLLM authenticates with a bearer header rather than cookies, the wildcard still\npermits untokenized access to an unauthenticated server and read access when the\ncaller already holds a token.\n\n### Details\n\nAffected components\n\n- `vllm/entrypoints/launchers/cli_args.py` - `allowed_origins` default value.\n- `vllm/entrypoints/serve/middleware/register.py` - `CORSMiddleware`\n  registration.\n- `vllm/entrypoints/serve/middleware/authenticate.py` - auth middleware and its\n  guarded path prefixes.\n\n Root cause\n\n`vllm/entrypoints/launchers/cli_args.py`:\n\n```python\nallow_credentials: bool = False\n\"\"\"Allow credentials.\"\"\"\nallowed_origins: list[str] = field(default_factory=lambda: [\"*\"])\n\"\"\"Allowed origins.\"\"\"\n```\n\n`vllm/entrypoints/serve/middleware/register.py`:\n\n```python\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=args.allowed_origins,\n    allow_credentials=args.allow_credentials,\n    allow_methods=args.allowed_methods,\n    allow_headers=args.allowed_headers,\n)\n```\n\nThe auth middleware is added only when a token is configured and guards only the\n`/v1`, `/v2`, `/inference`, and `/cohere` prefixes. `/v1/load_lora_adapter` and\n`/v1/unload_lora_adapter` are inside `/v1` and therefore do require a key when\none is set; they are open only when no key is configured and dynamic LoRA\nupdating is enabled.\n\n### Impact\n\n\n- A malicious page can enumerate models (`GET /v1/models`), issue\n  `POST /v1/chat/completions`, consume GPU time, and read model output through\n  the victim's browser.\n- When the server is reachable only from the victim's network, the browser acts\n  as a proxy a remote website could not otherwise use.\n- With `allow_credentials=False`, cookie-based CSRF does not apply; the exposure\n  is cross-origin request execution and response disclosure.\n\nThis advisory was fixed in [MR61009](https://github.com/vllm-project/vllm/pull/61009).","published":"2026-10-26T17:20:09.065Z","modified":"2026-10-28T02:59:28.956043526Z","cvss":{"score":3.4,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"vllm","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa","label":"vllm-project/vllm@fcae5c9"},"references":[{"type":"WEB","url":"https://github.com/vllm-project/vllm/releases/tag/v0.32.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115917.json"},{"type":"ADVISORY","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115917"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/pull/61009"},{"type":"PACKAGE","url":"https://github.com/vllm-project/vllm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:59:28.956043526Z"}}