CVE-2026-115917

mediumpriority · track · 19EPSS 0.002 · 15 %ileDEUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (15th) EPSS

CVSS 4.7 · medium

Is it mine?

2 products

Check your exposure

Who says so?

2 sources

cert_bund · nvd

EPSS · scored 2026-10-28

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. Cookie-based cross-site request forgery does not apply because credentials are disabled by default, and deployments requiring bearer authentication are exposed only when the caller already has a usable token. This issue is fixed in version 0.32.0.

cvss

Technical severity, 0–10. One row per scoring source.

4.7

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.1–4.7

v3.14.7mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 1.4

v3.13.4lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:Nsecondary · security-advisories@github.comexploitability 1.6 · impact 1.4

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-942USprimaryCWE-942US

affected products (2)

Products and version ranges known to be affected.

Open Source vllm< 0.32.0cert_bundDE
vllm vllm< 0.32.0nvdUScpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-4051vllm: Mehrere SchwachstellenDeutsch2026-10-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in vllm ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.

sources

Which sources assert this record, and when.

cert_bund nvd NVD CVE.org MITRE

published 2026-10-26modified 2026-10-28

related (170)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-114108US	critical9.8OT elevated	0.53% (45th)	—	2026-10-21
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth(…
CVE-2026-15966US	critical9.8	0.37% (31st)	—	2026-07-23
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before…
CVE-2025-27909US	critical9.8	0.21% (12th)	—	2025-08-18
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being lim…
CVE-2024-37131US	critical9.8	0.49% (42nd)	—	2024-06-13
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this…
CVE-2024-25124US	critical9.8	0.66% (51st)	—	2024-02-21
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CO…

+165 more

references (4) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan