vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
影響: pip:vllm < 0.32.0 → 0.32.0
The OpenAI-compatible server registers Starlette CORSMiddleware with allowed_origins defaulting to [""], and performs no authentication unless --api-key (or VLLM_API_KEY) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example localhost or an internal/VPN address) and read the responses. The default allow_credentials=False blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than c…
X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。
フォロー @vulnpulse_app| CVE | CVE-2026-115917 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/29 09:48 |
| データ | Markdown JSON |
2026/10/29 06:15、GitHub Advisory Databaseが「vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: Python、OpenAI。CVE: CVE-2026-115917。