VYPR
← All advisories
Critical severity9.1GHSA Advisory· Published Jun 22, 2026· Updated Sep 1, 2026

CVE-2026-48746

CVE-2026-48746

Description

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
vllmPyPI
>= 0.3.0, < 0.22.00.22.0

Affected products

12

Patches

Vulnerability mechanics

References

19

News mentions

2