CVE Intelligence
Analysis AI-assisted

CVE-2026-48746: vLLM Authentication Bypass in OpenAI-Compatible API Middleware

vLLM versions from 0.3.0 up to (but not including) 0.22.0 contain an authentication bypass in the OpenAI API AuthenticationMiddleware, which can allow requests without the configured API key. The record rates it critical with a CVSS 3.1 base score of 9.1 and states that it is fixed in 0.22.0. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

vLLM is an inference and serving engine for large language models. According to the record, the OpenAI-compatible API protection provided by AuthenticationMiddleware can be bypassed in affected releases. The weakness is linked to how ASGI web servers and Starlette trust those servers, and the record states that it is fixed in 0.22.0.

Impact

  • An attacker who can reach the API may be able to use it without the configured VLLM_API_KEY or --api-key.
  • The record reports a CVSS 3.1 base score of 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, which indicates network reachability, low complexity, no privileges and no user interaction, with high confidentiality and availability impact.
  • The record lists the weakness as CWE-444 (HTTP Request Smuggling), but its description does not explain how smuggling relates to the authentication bypass.

Affected products and versions

  • Product as recorded: vLLM (vendor and product listed as Vllm Vllm).
  • Affected range in the record: 0.3.0 or later and earlier than 0.22.0.
  • Fixed version stated in the description: 0.22.0. The structured fixes field of the record is empty, so the fixed version is taken from the description text.
  • Red Hat has published errata that reference this CVE; consult the vendor pages for downstream package versions.

Exploitation status

The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade vLLM to version 0.22.0 or later, as stated in the record description.
  • Until the upgrade is applied, restrict network access to the inference API to trusted clients and place it behind controls that do not depend solely on the application-level API key.
  • Review the upstream advisory and the pull request for the vendor's own description of the change: GitHub Security Advisory GHSA-94f4-hr76-p5j6 and pull request 43426.

Detection guidance

  • Inventory all vLLM deployments and record their installed versions to identify those in the affected range.
  • Review access logs of the inference API for successful requests from unexpected sources or without expected authentication context.
  • Check whether the service is reachable from networks beyond its intended trust boundary.

Limitations of the available information

  • The record does not describe the exact mechanism of the trust issue between ASGI servers and Starlette, nor the specific deployment conditions required.
  • The CWE classification as HTTP Request Smuggling is recorded but not explained in the description.
  • The structured fixes list is empty and no per-distribution fixed versions are given in the record.
  • No EPSS score or SSVC data is available.

For the official record see the NVD entry and the CVE.org record.

Frequently asked questions

Which vLLM versions are affected by CVE-2026-48746?

The record lists the affected range as 0.3.0 or later and earlier than 0.22.0.

What is the fixed version?

The record description states that the vulnerability is fixed in 0.22.0. The structured fixes field is empty, so confirm with the vendor advisory.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.