vLLM: ASGI request handling lets callers bypass API-key authentication on the OpenAI endpoints

Impact

Between 0.3.0 and 0.22.0, the authentication middleware on vLLM's OpenAI-compatible server trusts information from the ASGI layer in a way that can be manipulated, so a caller reaches the API without presenting VLLM_API_KEY or --api-key. Any operator who treated that key as the tenant boundary in front of a shared inference endpoint has no boundary. On a GPU fleet this means unmetered use of someone else's accelerators and access to whatever the served endpoints expose; the CVSS vector also rates availability high, consistent with an unauthenticated caller being able to saturate the server. The underlying issue is in the ASGI server and starlette's trust of it, so the same class of bypass may affect other starlette-based serving frontends.

Who can reach it

Any client with network reach to the vLLM HTTP port. No credentials needed — that is the point of the bug.

What to do

Upgrade to vLLM 0.22.0. Red Hat AI Inference Server 3.2 and 3.3 users take RHSA-2026:30088 / RHSA-2026:30089. Restarting each vLLM process drops in-flight requests and re-loads weights, so roll replicas one at a time behind the router rather than restarting a whole pool. Until patched, put a network ACL or authenticating proxy in front of the port instead of relying on the built-in API key.

References