CVE-2026-115917: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

### Summary The OpenAI-compatible server registers Starlette `CORSMiddleware` with `allowed_origins` defaulting to `["*"]`, and performs no authentication unless `--api-key` (or `VLLM_API_KEY`) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example `localhost` or an internal/VPN address) and read the responses. The default `allow_credentials=False` blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than cookies, the wildcard still permits untokenized access to an unauthenticated server and read access when the caller already holds a token. ### Details Affected components - `vllm/entrypoints/launchers/cli_args.py` - `allowed_origins` default value. - `vllm/entrypoints/serve/middleware/register.py` - `CORSMiddleware` registration. - `vllm/entrypoints/serve/middleware/authenticate.py` - auth middleware and its guarded path prefixes. Root cause `vllm/entrypoints/launchers/cli_args.py`: ```python allow_credentials: bool = False """Allow credentials.""" allowed_origins: list[str] = field(default_factory=lambda: ["*"]) """Allowed origins.""" ``` `vllm/entrypoints/serve/middleware/register.py`: ```python app.add_middleware( CORSMiddleware, allow_origins=args.allowed_origins, allow_credentials=args.allow_credentials, allow_methods=args.allowed_methods, allow_headers=args.allowed_headers, ) ``` The auth middleware is added only when a token is configured and guards only the `/v1`, `/v2`, `/inference`, and `/cohere` prefixes. `/v1/load_lora_adapter` and `/v1/unload_lora_adapter` are inside `/v1` and therefore do require a key when one is set; they are open only when no key is configured and dynamic LoRA updating is enabled. ### Impact - A malicious page can enumerate models (`GET /v1/models`), issue `POST /v1/chat/completions`, consume GPU time, and read model output through the victim's browser. - When the server is reachable only from the victim's network, the browser acts as a proxy a remote website could not otherwise use. - With `allow_credentials=False`, cookie-based CSRF does not apply; the exposure is cross-origin request execution and response disclosure. This advisory was fixed in [MR61009](https://github.com/vllm-project/vllm/pull/61009).

• github.com/vllm-project/vllm/security/advisories/GHSA-vvpg-rrww-wpmh (opens in a new tab)
• nvd.nist.gov/vuln/detail/CVE-2026-115917 (opens in a new tab)
• github.com/vllm-project/vllm/pull/61009 (opens in a new tab)
• github.com/vllm-project/vllm/commit/fcae5c98870ff2c20659731dce7ba3a3ff0d48aa (opens in a new tab)
• github.com/vllm-project/vllm (opens in a new tab)
• github.com/vllm-project/vllm/releases/tag/v0.32.0 (opens in a new tab)

• vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audioMediumVulnerability2026-10-28
• CVE-2026-115914: vLLM DeepSeek-OCR image processing vulnerable to denial of serviceMediumVulnerability2026-10-28
• CVE-2026-115915: vLLM · Untrusted EPS inputs can trigger denial of service or Ghostscript RCEHighVulnerability2026-10-28
• vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledHighVulnerability2026-10-28
• vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash /MediumVulnerability2026-10-28