vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
The vulnerability results from improper handling of HTTP requests by ASGI servers combined with incorrect trust by the Starlette framework of these servers (CWE-444: HTTP Request/Response Smuggling, CWE-501: Trust Boundary Violation). The AuthenticationMiddleware mechanism responsible for verifying the API key can be bypassed through a crafted network request. As a result, the middleware fails to enforce proper identity verification, allowing unauthorized access to protected API resources.
An attacker gains unauthorized access to the vLLM server API — can read data (C:H) and potentially cause service unavailability (A:H), without needing a valid API key.
Update vLLM to version 0.22.0 or later. Red Hat errata are also available: RHSA-2026:30088 and RHSA-2026:30089. Until updating, it is recommended to restrict network access to vLLM API endpoints using a firewall or reverse proxy with its own authentication layer.
vLLM in versions 0.3.0 to 0.21.x (vulnerability fixed in version 0.22.0)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HVllm
APPVllm0.3.0 – 0.22.0 (excl.)
Related vulnerabilities
vLLM: wyciek adresu sterty umożliwiający RCE przez endpoint multimodalny
vLLM: niezamierzone nasłuchiwanie TCPStore na wszystkich interfejsach sieciowych
RCE w vLLM poprzez deserializację pickle na niezabezpieczonych gniazdach ZeroMQ
RCE przez niebezpieczną deserializację w vllm MessageQueue.dequeue()
RCE przez niebezpieczną deserializację w vLLM z Mooncake (ZMQ/TCP)