PT-2026-50144 · Pypi · Vllm

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-48746

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions vLLM versions 0.3.0 through 0.21.0

Description An authentication bypass exists in the OpenAI API AuthenticationMiddleware due to improper trust in the reconstructed URL path from the ASGI scope. The url path is derived from a URL object reconstructed by starlette using the request scope, which includes the Host header. Because starlette and ASGI servers (such as uvicorn) do not properly filter the Host header for invalid characters, an attacker can inject special characters like / or ? into the Host header to manipulate the .path attribute. Since FastAPI and starlette routing rely on the HTTP path rather than the parsed url.path attribute, an attacker can bypass authentication checks for routes starting with /v1 and access the API without a valid VLLM API KEY or --api-key. Instances behind RFC-conforming web servers, such as nginx, are not affected.

Recommendations Update to version 0.22.0.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-48746

GHSA-94F4-HR76-P5J6

Affected Products

Vllm

References · 6

• https://osv.dev/vulnerability/GHSA-94f4-hr76-p5j6 · Vendor Advisory
• https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6 · Note
• https://github.com/vllm-project/vllm/pull/43426 · Note
• https://github.com/vllm-project/vllm · Note
• https://x41-dsec.de/lab/advisories/x41-2026-002-starlette · Note
• https://twitter.com/UpwindMDR/status/2066992369904603247 · Twitter Post