CVE-2026-48746 — vLLM: OpenAI auth bypass

Affected: vllm-project vllm, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 2.25, Red Hat Exploit Intelligence, Red Hat OpenShift Lightspeed, Red Hat AI Inference Server and 5 more

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

GHSA-94f4-hr76-p5j6 — vLLM: OpenAI auth bypass

Affected: PyPI: vllm

### Summary

A vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API `AuthenticationMiddleware`, which was discovered during @x41sec's source code audit. It allows to use the API without providing the configured `VLLM_API_KEY` or `--api-key`.

### Details

In https://github.com/vllm-project/vllm/blob/v0.14.0/vllm/entrypoints/openai/api_server.py#L689-L692 the `url_path` is taken from the `URL`, which is reconstructed by _starlette_ based on the request `scope`.

```py from starlette.datastructures import URL, Headers, MutableHeaders, State

# ...

url_path = URL(scope=scope).path.removeprefix(root_path) headers = Headers(scope=scope) if url_path.startswith("/v1") and not self.verify_token(headers): response = JSONResponse(content={"error": "Unauthorized"}, status_code=401) return response(scope, receive, send) return self.app(scope, receive, send) ```

The request `scope` includes the request's `Host:` header and reconstructs the URL as shown below:

```py f"{scheme}://{host_header}{path}" ```

Neither starlette nor [any of the ASGI servers](https://asgi.readthedocs.io/en/latest/implementations.html#servers) (including uvicorn, which vllm uses) properly filter the `Host:` header for invalid characters. This allows an attacker to include special URL characters such as `/` or `?` in the `Host:` header and thereby control the reconstructed URL and it's `.path` attribute.

FastAPI/starlette's routi…

Most recent entries from all

CVE-2026-48746 — vLLM: OpenAI auth bypass

GHSA-94f4-hr76-p5j6 — vLLM: OpenAI auth bypass