{"data":{"id":"8d9f1c8f-1935-4898-b517-9c04daa18011","title":"CVE-2026-115917: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server…","summary":"vLLM versions prior to 0.32.0 configure the OpenAI-compatible server's Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to call unauthenticated vLLM endpoints such as GET /v1/models and POST /v1/chat/completions on localhost, an internal network, or a VPN, consuming GPU resources and reading responses. Credentials are disabled by default, so cookie-based cross-site request forgery does not apply, and deployments using bearer authentication are exposed only when the caller already holds a usable token.","solution":"Fixed in version 0.32.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115917","publishedAt":"2026-10-26T18:17:39.263Z","cveId":"CVE-2026-115917","cweIds":["CWE-942"],"cvssScore":"3.4","cvssSeverity":"low","severity":"low","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-27T06:10:23.084Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-27T06:10:29.456Z","patchAvailable":null,"disclosureDate":"2026-10-26T18:17:39.263Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}