Beschreibung
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette-s trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
CVSS 9.1EPSS 1.1520000000000001%Risiko 1
Quelle öffnen- Veröffentlicht
- 2026-06-22 23:16:30
- Betroffene Versionen
- <0.22.0
- Typ
- Kritische Software
- Zuletzt geändert
- 2026-08-11 13:18:56
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H