GPU VulnDB

Database/AI/ML frameworks & serving

vLLM: OpenAI-compatible server ships a wildcard CORS origin, letting any web page drive it from a browser

CVSS 4.7CVE-2026-115917AI/ML frameworks & servingcurated

Impact

Before 0.32.0 the vLLM OpenAI-compatible server sets allowed_origins to a wildcard, so any web page a user visits can make their browser call a vLLM endpoint that is otherwise only reachable on localhost, an internal subnet or a VPN, and read the responses. That means GET /v1/models to enumerate what a cluster serves and POST /v1/chat/completions to burn GPU time on someone else's accelerators and read the generated output. On a fleet where inference endpoints are deliberately left unauthenticated because they sit on a private network, a developer workstation on the VPN becomes the bridge into them. Credentials are disabled by default so cookie-based CSRF does not apply, and a deployment that requires a bearer token is only reachable by a caller who already holds one.

Who can reach it

Remote and unauthenticated against the vLLM server itself, but it requires a victim with network reach to that server to load an attacker-controlled web page. No vLLM credentials are needed where the server is deployed without bearer authentication.

What to do

Upgrade to vLLM 0.32.0 or later and restart each API server process; the change is in the server's CORS configuration, so no GPU driver or node work is involved. Until then, set an explicit allowed-origins list, require bearer authentication, or keep the port bound to an interface that browsers on user networks cannot reach.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-115917https://github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmhhttps://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aahttps://github.com/vllm-project/vllm/releases/tag/v0.32.0

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.