Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette-s trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
CVSS 9.1EPSS 1.1520000000000001%Risk 1
View source- Published
- 2026-06-22 23:16:30
- Affected versions
- <0.22.0
- Type
- Critical software
- Last modified
- 2026-08-11 13:18:56
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H