CVE-2026-48746 Details
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
A vulnerability allowing authentication bypass in the OpenAI API has been identified in vLLM versions 0.3.0 through 0.21.0. This issue arises from ASGI web servers and starlette's reliance on those servers, enabling users to access the API without the required VLLM_API_KEY or command-line API key. The vulnerability is rooted in starlette's improper validation of the Host header, which can be exploited to manipulate the request path and bypass authentication middleware. Instances of vLLM using an API key for the OpenAI API and exposing the API to attackers are affected, while those behind a compliant web server like nginx are not.
Users can update to vLLM version 0.22.0 or later, where this vulnerability has been patched. Additionally, deploying a reverse proxy that rejects invalid Host headers, such as nginx or Apache HTTP Server, in front of the Python application can help mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
| CWE-501 | Trust Boundary Violation | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| vllm vllm | >= 0.3.0, < 0.22.0 |
CPE
Remediation
| |
Change History
16 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | redhat-SADP |
| Sep 1, 2026 | CVE Modified | redhat-SADP |
| Sep 1, 2026 | CVE Modified | CISA-ADP |
| Sep 1, 2026 | CVE Modified | [email protected] |
| Aug 19, 2026 | CVE Modified | redhat-SADP |
| Aug 14, 2026 | CVE Modified | redhat-SADP |
| Aug 11, 2026 | CVE Modified | redhat-SADP |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 7, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |