{"id":"CVE-2026-48746","aliases":["GHSA-94f4-hr76-p5j6","PYSEC-2026-226"],"url":"https://o3.security/vulnerability/CVE-2026-48746","summary":"vLLM: OpenAI auth bypass","details":"### Summary\n\nA vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API `AuthenticationMiddleware`, which was discovered during @x41sec's source code audit.\nIt allows to use the API without providing the configured `VLLM_API_KEY` or `--api-key`.\n\n### Details\n\nIn https://github.com/vllm-project/vllm/blob/v0.14.0/vllm/entrypoints/openai/api_server.py#L689-L692 the `url_path` is taken from the `URL`, which is reconstructed by _starlette_ based on the request `scope`.\n\n```py\nfrom starlette.datastructures import URL, Headers, MutableHeaders, State\n\n# ...\n\nurl_path = URL(scope=scope).path.removeprefix(root_path)\nheaders = Headers(scope=scope)\nif url_path.startswith(\"/v1\") and not self.verify_token(headers):\n    response = JSONResponse(content={\"error\": \"Unauthorized\"}, status_code=401)\n    return response(scope, receive, send)\nreturn self.app(scope, receive, send)\n```\n\nThe request `scope` includes the request's `Host:` header and reconstructs the URL as shown below:\n\n```py\nf\"{scheme}://{host_header}{path}\"\n```\n\nNeither starlette nor [any of the ASGI servers](https://asgi.readthedocs.io/en/latest/implementations.html#servers) (including uvicorn, which vllm uses) properly filter the `Host:` header for invalid characters. This allows an attacker to include special URL characters such as `/` or `?` in the `Host:` header and thereby control the reconstructed URL and it's `.path` attribute.\n\nFastAPI/starlette's routing uses the HTTP path and does not depend on the parsed url.path attribute, allowing attackers to reach an endpoint via a certain path while providing a different value in the `.path`.\n\n### Impact\n- Instances of vllm that use an API Key for the OpenAI API and expose the API to attackers.\n- Instances behind an RFC-conforming web server (such as nginx) are **not** affected.","published":"2026-06-22T21:57:28.997Z","modified":"2026-09-18T03:31:02.168937474Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"epss":{"score":0.01152,"percentile":0.65221,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"vllm","fixedVersion":"0.22.0"}],"fix":{"url":"https://github.com/vllm-project/vllm/pull/43426","label":"vllm-project/vllm#43426"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48746.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36005"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36006"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42132"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42142"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:61627"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:61629"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-48746"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48746.json"},{"type":"ADVISORY","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48746"},{"type":"ADVISORY","url":"https://x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491581"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/pull/43426"},{"type":"PACKAGE","url":"https://github.com/vllm-project/vllm"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-226.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T03:31:02.168937474Z"}}