{"id":"CVE-2026-115917","title":"vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server","summary":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim…","severity":"low","cvss":3.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-942"],"vendor":"vllm-project","product":"vllm","affected":["vllm < 0.32.0"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T17:20:09.065Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115917","references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmh","label":"https://github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmh"},{"url":"https://github.com/vllm-project/vllm/pull/61009","label":"https://github.com/vllm-project/vllm/pull/61009"},{"url":"https://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa","label":"https://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa"},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.32.0","label":"https://github.com/vllm-project/vllm/releases/tag/v0.32.0"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T17:33:33.055Z","epss":0.00238,"epssPercentile":0.14743,"slug":"CVE-2026-115917","body":"## Overview\n\nvLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.\n\n## Affected\n\n- `vllm < 0.32.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":18.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}