CVE-2026-115917: vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed to browser-based abuse?
Unauthenticated vLLM HTTP servers reachable from a victim's browser are exposed, including servers bound to localhost, internal networks, or VPN-accessible networks. A malicious web page can invoke model-listing and chat-completion endpoints through the browser.
Does bearer authentication prevent this issue?
Deployments requiring bearer authentication are exposed only if the caller already has a usable token. The default configuration does not use credentials, so cookie-based cross-site request forgery is not applicable.
What can an attacker do through the vulnerable cross-origin policy?
An attacker can cause the victim's browser to send requests such as GET /v1/models and POST /v1/chat/completions to a reachable unauthenticated server. This can disclose responses and consume GPU resources.
What version fixes the issue?
Upgrade vLLM to version 0.32.0, which fixes the permissive default CORS origin configuration.