--- id: CVE-2026-48746 title: vLLM is an inference and serving engine for large language models (LLMs) summary: >- vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API Authenti… severity: critical cvss: 9.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H' cwe: - CWE-444 - CWE-501 vendor: vllm product: vllm affected: - 'vllm >= 0.3.0, < 0.22.0' patched: - vllm 0.22.0 published: '2026-06-22' updated: '2026-09-16' sourceUpdated: '2026-09-16T13:18:00.653' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48746' references: - url: 'https://github.com/vllm-project/vllm/pull/43426' label: security-advisories@github.com - url: >- https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6 label: security-advisories@github.com - url: 'https://x41-dsec.de/lab/advisories/x41-2026-002-starlette' label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:30088' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30089' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36005' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36006' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42132' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42142' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42644' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:43038' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61627' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61629' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-48746' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2491581' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48746.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://x41-dsec.de/lab/advisories/x41-2026-002-starlette' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48746' - url: 'https://github.com/vllm-project/vllm' - url: >- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-226.yaml - url: 'https://github.com/advisories/GHSA-94f4-hr76-p5j6' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-48746' - url: 'https://access.redhat.com/errata/RHSA-2026:69466' - url: 'https://access.redhat.com/errata/RHSA-2026:69467' - url: 'https://access.redhat.com/errata/RHSA-2026:69469' - url: 'https://access.redhat.com/errata/RHSA-2026:69464' - url: 'https://access.redhat.com/errata/RHSA-2026:70965' - url: 'https://access.redhat.com/errata/RHSA-2026:70979' - url: 'https://access.redhat.com/errata/RHSA-2026:70995' - url: 'https://access.redhat.com/errata/RHSA-2026:70969' tags: - nvd - cve.org - exploit-available - osv - pip - ghsa - csaf - vex - red-hat epss: 0.01152 epssPercentile: 0.65585 aliases: - GHSA-94f4-hr76-p5j6 - PYSEC-2026-226 ecosystem: pip exploitAvailable: true ssvc: exploitation: poc automatable: 'yes' technicalImpact: partial timestamp: '2026-06-23T14:01:22.798843Z' ingestedAt: '2026-06-29T14:31:47.730Z' --- ## Overview vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0. ## Affected - `vllm >= 0.3.0, < 0.22.0` ## Remediation Upgrade past the affected range: - `vllm 0.22.0` ## Package advisory (CVE-2026-48746) Affected packages: - `vllm >= 0.3.0, < 0.22.0` Patched in: - `vllm 0.22.0` Source: https://osv.dev/vulnerability/GHSA-94f4-hr76-p5j6 ## Vendor advisories - **RHSA-2026:61627** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61627) - **RHSA-2026:36005** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:36005) - **RHSA-2026:61629** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61629) - **RHSA-2026:36006** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:36006) - **RHSA-2026:30089** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30089) - **RHSA-2026:30088** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30088) - **RHSA-2026:42132** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42132) - **RHSA-2026:42142** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42142) - **RHSA-2026:43038** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43038) - **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644) - **Red Hat VEX** · Important · affected: Exploit Intelligence, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Exploit Intelligence, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48746.json) - **RHSA-2026:69466** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69466) - **RHSA-2026:69467** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69467) - **RHSA-2026:69469** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69469) - **RHSA-2026:69464** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69464) - **RHSA-2026:70965** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70965) - **RHSA-2026:70979** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70979) - **RHSA-2026:70995** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70995)