{"id":"ghsa-ghsa-vvpg-rrww-wpmh","seq":2056924,"kind":"advisory","title":"vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server","url":"https://github.com/advisories/GHSA-vvpg-rrww-wpmh","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vvpg-rrww-wpmh","summary":"影響: pip:vllm < 0.32.0 → 0.32.0\nThe OpenAI-compatible server registers Starlette CORSMiddleware with allowed_origins defaulting to [\"\"], and performs no authentication unless --api-key (or VLLM_API_KEY) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example localhost or an internal/VPN address) and read the responses. The default allow_credentials=False blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than c…","severity":"low","techs":["python","openai"],"cves":["CVE-2026-115917"],"tags":["GHSA-vvpg-rrww-wpmh","vllm"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:15:49.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}