vLLM: OpenAI auth bypass
vLLM
More for vLLM RSS feed for vLLM
- Severity
- Critical, CVSS 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Record
- CVE-2026-48746
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 22, 2026
- Source last modified
- October 25, 2026
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
Description quoted from the NVD record.
Who is affected
vLLM is software that runs AI language models and answers requests sent to them by other programs. This flaw affects vLLM versions 0.3.0 to before 0.22.0. It is in the part that checks the access key for vLLM's OpenAI-compatible interface, which is the connection other programs use to talk to it. Because of a weakness in the web server software that vLLM relies on, someone can use this interface without providing the access key you set up. This matters if your organization runs vLLM and counts on that key to keep others out. This flaw is rated Critical.
What to do
- Whoever installed or runs vLLM for your organization should act on this. Ask them to check which version of vLLM is running.
- If the version is 0.3.0 or later but before 0.22.0, update vLLM to
0.22.0or later. That version fixes this flaw. - If an IT provider or vendor runs vLLM for your organization, send them this advisory and ask when the update will be done.
- If you are not sure whether anyone in your organization uses vLLM, ask the person who looks after your servers or AI tools.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.