CVE-2026-115917

vLLM wildcard CORS exposes browser-reachable inference services

vLLM project · vLLM OpenAI-compatible server

First documented disclosure · Review checkpoint

Summary

A malicious website could use a visitor’s browser to query and read a reachable unauthenticated inference server.

Severity and exploitation evidence

Low · 3.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The default CORS policy allowed all origins while API authentication required separate configuration.

Conditions required

The victim visits the website and their browser can reach the vLLM instance. A bearer-protected server additionally requires a usable token.

Potential impact

Model enumeration, inference consumption and disclosure of returned model output.

Affected versions and configurations

Before 0.32.0.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade, configure trusted browser origins explicitly, and require API authentication.

Operating lesson

Network location and CORS do not substitute for authentication.

Evidence and limits

Public October 10 patch predates October 20 advisory and October 26 CVE publication. Cookie-based CSRF is not the reported mechanism because credentials are disabled by default. CORS does not prevent all simple requests from being sent.

Sources