vLLM CVE-2026-115917

Exploitation requires all of the following: a vLLM OpenAI-compatible server prior to 0.32.0 running the default CORSMiddleware wildcard (allowed_origins=['*']); the server being reachable from the victim's browser (localhost, internal network, or VPN address); no --api-key/VLLM_API_KEY configured, which leaves endpoints such as GET /v1/models and POST /v1/chat/completions unauthenticated (or, if a key is set, the browser caller already holding a usable bearer token for read access); and the victim actively loading an attacker-controlled web page (required user interaction, UI:R). Limiting factors: cookie-based CSRF does not apply because credentials are disabled by default; when an API key is configured the /v1, /v2, /inference, and /cohere prefixes are gated, so a tokenless attacker cannot reach guarded endpoints. The only complete fix stated by the vendor is upgrading to 0.32.0, which changes the default allowed_origins to an empty list.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS base score is 3.4 (Low) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N: although reachable over the network, exploitation requires user interaction (the victim must load an attacker-controlled page) and higher attack complexity (a vulnerable, browser-reachable, unauthenticated vLLM server must already exist). Confidentiality impact is only Low (an attacker can read model output and enumerate models through the victim's browser), with no integrity impact and no rated availability impact despite GPU-time consumption. The vuln.today Decision label is 'monitor', which aligns with the low severity and does not indicate urgency. No EPSS score and no KEV status were provided in the input, and there is no public exploit reference - only vendor advisory, fix PR, fix commit, and release links. Taken together this is a legitimately defensive, low-real-risk hardening fix rather than an actively exploited emergency; absence of EPSS/KEV data is noted, not treated as evidence either way.

A victim with a locally or internally reachable vLLM OpenAI-compatible server (default configuration, no API key) visits a malicious web page. Because the server registers CORSMiddleware with allowed_origins=['*'], the attacker's JavaScript can call GET /v1/models and POST /v1/chat/completions through the victim's browser, consume GPU resources, and read the responses cross-origin. No public exploit identified at time of analysis; the browser effectively acts as a proxy into networks the remote site could not otherwise reach.