CVE-2026-115917: vllm — Fix

Description

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.

Is your site exposed to CVE-2026-115917?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.4

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS — Exploit Prediction

0.0024

Probability of exploitation

0.15%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-942 CWE-942

Affected Products

Vendor	Product	Versions
vllm	vllm	< 0.32.0

References

Advisories & Patches

https://github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa https://github.com/vllm-project/vllm/pull/61009 https://github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmh

Other References

https://github.com/vllm-project/vllm/releases/tag/v0.32.0

Frequently Asked Questions

What is CVE-2026-115917? +

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0. It has a CVSS v3.1 base score of 3.4 (LOW).

How severe is CVE-2026-115917? +

CVE-2026-115917 has a CVSS v3.1 score of 3.4 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0024, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-115917? +

CVE-2026-115917 affects products from vllm, specifically: vllm. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-115917? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-53276

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS …

CVE-2024-49763

PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper …

CVE-2025-41010

Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) allows browsers to make cross-domain requests in …

CVE-2025-57755

claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper …

CVE-2025-41366

In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability …

CVE-2026-65957

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the …