CVE-2026-48746 is an authentication bypass vulnerability in vLLM, an inference and serving engine for large language models, affecting versions >=0.3.0 and <0.22.0. The flaw resides in ASGI web servers and Starlette's trust in them, allowing an attacker to craft a Host header that causes the OpenAI API AuthenticationMiddleware to check a different URL path than the one actually dispatched. This bypasses the configured VLLM_API_KEY or --api-key, enabling unauthorized access to the inference API. The vulnerability does not allow integrity compromise or arbitrary code execution but can lead to confidentiality loss (model and prompt abuse) and availability impact (resource exhaustion). Exploitation requires the API key authentication feature to be enabled and the service to be accessible without an RFC-conforming reverse proxy that normalizes the Host header. The vulnerability is fixed in vLLM version 0.22.0.

Successful exploitation allows unauthorized inference API access without authentication, leading to confidentiality loss through model or prompt abuse and availability impact due to potential resource exhaustion. There is no impact on data integrity or code execution. The vulnerability requires network access to the vLLM endpoint and the API key authentication to be enabled. Deployments behind compliant reverse proxies that normalize the Host header are not vulnerable. Red Hat rates the impact as Important due to conditional deployment factors, while the CVSS score is 9.1 (critical).

A patch is available in vLLM version 0.22.0 that fixes this authentication bypass vulnerability. Users should upgrade to version 0.22.0 or later. Additionally, restrict network access to the vLLM API endpoint to trusted clients and internal networks by implementing firewall rules or network policies to reduce exposure. Deploy the service behind an RFC-conforming reverse proxy that normalizes the Host header to prevent exploitation. These mitigations reduce the attack surface and prevent unauthorized access.