中文

// CVE · PUBLISHED 2026-06-22

CVE-2026-48746

vllm-project / vllm · Red Hat / Red Hat AI Inference Server 3.2 · Red Hat / Red Hat AI Inference Server 3.3 · +12

9.1 · CVSS 3.1Critical

Description

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

References

Related CVEs

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.