Vulnerabilities CVE-2026-48746

CVE-2026-48746

Critical

Open

TLP:CLEAR

vLLM: OpenAI auth bypass

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

Details

CVSS Score: 9.1
EPSS Score ⓘ: 1.15%

64th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Confidence: 90%
Published: Jun 22, 2026
Last Modified: Aug 11, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.