CVE-2026-115917

Summary

The OpenAI-compatible server registers Starlette CORSMiddleware with
allowed_origins defaulting to ["*"], and performs no authentication unless
--api-key (or VLLM_API_KEY) is configured. A web page on any origin can send
requests to a vLLM server that the victim's browser can reach (for example
localhost or an internal/VPN address) and read the responses. The default
allow_credentials=False blocks cookie-bearing cross-origin requests; because
vLLM authenticates with a bearer header rather than cookies, the wildcard still
permits untokenized access to an unauthenticated server and read access when the
caller already holds a token.

Details

Affected components

• vllm/entrypoints/launchers/cli_args.py - allowed_origins default value.
• vllm/entrypoints/serve/middleware/register.py - CORSMiddleware
  registration.
• vllm/entrypoints/serve/middleware/authenticate.py - auth middleware and its
  guarded path prefixes.

Root cause

vllm/entrypoints/launchers/cli_args.py:

allow_credentials: bool = False
"""Allow credentials."""
allowed_origins: list[str] = field(default_factory=lambda: ["*"])
"""Allowed origins."""

vllm/entrypoints/serve/middleware/register.py:

app.add_middleware(
    CORSMiddleware,
    allow_origins=args.allowed_origins,
    allow_credentials=args.allow_credentials,
    allow_methods=args.allowed_methods,
    allow_headers=args.allowed_headers,
)

The auth middleware is added only when a token is configured and guards only the
/v1, /v2, /inference, and /cohere prefixes. /v1/load_lora_adapter and
/v1/unload_lora_adapter are inside /v1 and therefore do require a key when
one is set; they are open only when no key is configured and dynamic LoRA
updating is enabled.

Impact

• A malicious page can enumerate models (GET /v1/models), issue
  POST /v1/chat/completions, consume GPU time, and read model output through
  the victim's browser.
• When the server is reachable only from the victim's network, the browser acts
  as a proxy a remote website could not otherwise use.
• With allow_credentials=False, cookie-based CSRF does not apply; the exposure
  is cross-origin request execution and response disclosure.

This advisory was fixed in MR61009.