CVE-2026-48746: vLLM: OpenAI auth bypass

Synopsis

An authentication bypass vulnerability exists in vLLM, the open-source inference and serving engine for large language models, affecting versions 0.3.0 through 0.22.0. The flaw stems from how ASGI web servers and the Starlette framework handle trust propagation, allowing the OpenAI API AuthenticationMiddleware to be bypassed entirely; an unauthenticated remote attacker can reach the API over the network with no credentials required. Successful exploitation lets an attacker query and consume the hosted LLM API freely and potentially disrupt service availability. No fix version has been published yet; HarborGuard tracks this advisory and will flag a patched-image rebuild as available the moment an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vLLM API endpoint over the network; the service must be exposed to an adjacent or public network for exploitation to occur.

• AuthenticationNot required

  No credentials are needed; the vulnerability bypasses the configured VLLM_API_KEY or --api-key check entirely, granting access without any account or token.

• Victim interactionNot required

  Exploitation is fully server-side; no user action, click, or session is required from any legitimate user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the bypass is reliable and requires no race conditions, special memory layout, or environmental preconditions beyond network access to the API.

Blast Radius

• Reads responses from the hosted LLM API without authorization, potentially exposing proprietary model outputs, system prompts, and any data passed through inference requests.
• Sends unlimited API requests under the identity of an unauthenticated caller, exhausting GPU compute and degrading or crashing the inference service for legitimate users.
• Bypasses usage quotas and rate limits tied to API key validation, enabling cost amplification or resource starvation against the hosting environment.