CVE-2026-48746
Last modified
CVE-2026-48746 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. EPSS estimates a 1.15% chance of exploitation in the next 30 days.
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vllm | Vllm | >= 0.3.0, < 0.22.0 |
References
- https://github.com/vllm-project/vllm/pull/43426Issue Tracking
- https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6Third Party Advisory
- https://x41-dsec.de/lab/advisories/x41-2026-002-starletteThird Party Advisory
- https://x41-dsec.de/lab/advisories/x41-2026-002-starletteThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-48746?
How severe is CVE-2026-48746?
How do I fix CVE-2026-48746?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-48734ImageMagick is free and open-source software used for editin…5.5
- CVE-2026-48735pypdf is a free and open-source pure-python PDF library. Pri…5.5
- CVE-2026-48736Symfony is a PHP framework for web and console applications …8.6
- CVE-2026-4874A flaw was found in Keycloak. An authenticated attacker can …3.1
- CVE-2026-48743Envoy is an open source edge and service proxy designed for …7.5
- CVE-2026-48745Traccar Client is a GPS tracking mobile app for sending loca…9.3
- CVE-2026-48747Symfony is a PHP framework for web and console applications …5.3
- CVE-2026-48748Netty is a network application framework for development of …7.5
- CVE-2026-4875A vulnerability was determined in itsourcecode Free Hotel Re…4.7
- CVE-2026-48758sigstore-js provides JavaScript libraries for interacting wi…5.4
- CVE-2026-48759TypeBot is a chatbot builder tool. Versions 3.15.2 and below…7.1
- CVE-2026-4876A vulnerability was identified in itsourcecode Free Hotel Re…6.3
Are you affected by CVE-2026-48746?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST