UpHeron
All vulnerabilities

Servers and applications

CVE-2026-115917

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

Severity
Medium 4.7
Published
26 Oct 2026
Last changed
31 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.32.0
Sources
NVD, CVE Program

Description

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST…

Affected software

SoftwareAffected versions
vLLMServers and applications · cna:vllm-project|vllm
  • Every version before 0.32.0
vLLMServers and applications · cpe:a:vllm:vllm
  • Every version before 0.32.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-115917
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-115917