vLLM's default CORS origins are too permissive, allowing cross-origin requests to its HTTP server
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
vLLM's OpenAI-compatible server sets the CORS allowed origins to ["*"] by default, and when --api-key or VLLM_API_KEY is not configured it performs no authentication, so any web page can send cross-origin requests to a vLLM server reachable from the victim's browser (such as localhost or an intranet/VPN address) and read the responses. A malicious page can thereby enumerate models (GET /v1/models), call POST /v1/chat/completions, consume GPU time, and read model outputs; when the server is reachable only within the victim's network, the browser acts as a proxy that remote websites could not otherwise use. The default allow_credentials=False makes cookie-based CSRF inapplicable; the risk lies in cross-origin request execution and response leakage. This vulnerability (CVE-2026-115917) affects vllm (pip) versions before 0.32.0 and has been fixed in 0.32.0 (MR61009).
vLLM's default CORS allows any origin and there is no authentication by default; a malicious webpage can use a visitor's browser to call intranet inference services, and teams deploying vLLM can use this to check their configuration and version.