CVE-2026-115917: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server…

Summary

vLLM versions prior to 0.32.0 configure the OpenAI-compatible server's Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to call unauthenticated vLLM endpoints such as GET /v1/models and POST /v1/chat/completions on localhost, an internal network, or a VPN, consuming GPU resources and reading responses. Credentials are disabled by default, so cookie-based cross-site request forgery does not apply, and deployments using bearer authentication are exposed only when the caller already holds a usable token.

Mitigation

Fixed in version 0.32.0.

Topics

• Inference infrastructure

Related items

• MediumCVE-2026-115922: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-115921: ONNX shape inference crash from malicious model scan attributesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115920: ONNX ConvTranspose shape inference crash from malformed weight tensorSimilar attack · NVD/CVE Database
• MediumCVE-2026-115919: ONNX shape inference out-of-bounds read via malformed RNN, LSTM and GRU nodesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115918: vLLM Jinja chat template injection through /v1/responses endpointSimilar attack · NVD/CVE Database