GHSA-vvpg-rrww-wpmh

Suggest an improvement
Source
https://github.com/advisories/GHSA-vvpg-rrww-wpmh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vvpg-rrww-wpmh/GHSA-vvpg-rrww-wpmh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vvpg-rrww-wpmh
Aliases
Downstream
CGA (6)
Published
2026-10-28T21:15:49Z
Modified
2026-10-29T11:11:01Z
Severity
  • 3.4 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N CVSS Calculator
Summary
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
Details

Summary

The OpenAI-compatible server registers Starlette CORSMiddleware with allowed_origins defaulting to ["*"], and performs no authentication unless --api-key (or VLLM_API_KEY) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example localhost or an internal/VPN address) and read the responses. The default allow_credentials=False blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than cookies, the wildcard still permits untokenized access to an unauthenticated server and read access when the caller already holds a token.

Details

Affected components

  • vllm/entrypoints/launchers/cli_args.py - allowed_origins default value.
  • vllm/entrypoints/serve/middleware/register.py - CORSMiddleware registration.
  • vllm/entrypoints/serve/middleware/authenticate.py - auth middleware and its guarded path prefixes.

Root cause

vllm/entrypoints/launchers/cli_args.py:

allow_credentials: bool = False
"""Allow credentials."""
allowed_origins: list[str] = field(default_factory=lambda: ["*"])
"""Allowed origins."""

vllm/entrypoints/serve/middleware/register.py:

app.add_middleware(
    CORSMiddleware,
    allow_origins=args.allowed_origins,
    allow_credentials=args.allow_credentials,
    allow_methods=args.allowed_methods,
    allow_headers=args.allowed_headers,
)

The auth middleware is added only when a token is configured and guards only the /v1, /v2, /inference, and /cohere prefixes. /v1/load_lora_adapter and /v1/unload_lora_adapter are inside /v1 and therefore do require a key when one is set; they are open only when no key is configured and dynamic LoRA updating is enabled.

Impact

  • A malicious page can enumerate models (GET /v1/models), issue POST /v1/chat/completions, consume GPU time, and read model output through the victim's browser.
  • When the server is reachable only from the victim's network, the browser acts as a proxy a remote website could not otherwise use.
  • With allow_credentials=False, cookie-based CSRF does not apply; the exposure is cross-origin request execution and response disclosure.

This advisory was fixed in MR61009.

Database specific 
{
    "cwe_ids":  [
        "CWE-942"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-28T21:15:49Z",
    "nvd_published_at":  "2026-10-26T18:17:39Z",
    "severity":  "LOW"
}
References

Affected packages

PyPI / vllm

Package

Name
vllm
View open source insights on deps.dev
Purl
pkg:pypi/vllm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.32.0

Affected versions

0.*
0.0.1
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.2.0
0.2.1
0.2.1.post1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
0.4.0.post1
0.4.1
0.4.2
0.4.3
0.5.0
0.5.0.post1
0.5.1
0.5.2
0.5.3
0.5.3.post1
0.5.4
0.5.5
0.6.0
0.6.1
0.6.1.post1
0.6.1.post2
0.6.2
0.6.3
0.6.3.post1
0.6.4
0.6.4.post1
0.6.5
0.6.6
0.6.6.post1
0.7.0
0.7.1
0.7.2
0.7.3
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.5.post1
0.9.0
0.9.0.1
0.9.1
0.9.2
0.10.0
0.10.1
0.10.1.1
0.10.2
0.11.0
0.11.1
0.11.2
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.15.1
0.16.0
0.17.0
0.17.1
0.18.0
0.18.1
0.19.0
0.19.1
0.20.0
0.20.1
0.20.2
0.21.0
0.22.0
0.22.1
0.23.0
0.24.0
0.25.0
0.25.1
0.26.0
0.27.0
0.27.1
0.28.0
0.29.0
0.30.0
0.31.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vvpg-rrww-wpmh/GHSA-vvpg-rrww-wpmh.json"