vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

影響: pip:vllm < 0.32.0 → 0.32.0

The OpenAI-compatible server registers Starlette CORSMiddleware with allowed_origins defaulting to [""], and performs no authentication unless --api-key (or VLLM_API_KEY) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example localhost or an internal/VPN address) and read the responses. The default allow_credentials=False blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than c…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:15, GitHub Advisory Database에서 "vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: Python, OpenAI. CVE: CVE-2026-115917.