9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48746

CVE-2026-48746: vLLM: OpenAI auth bypass

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48746

CVE-2026-48746:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	>= 0.3.0, < 0.22.0	0.22.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass in the AuthenticationMiddleware of vLLM's OpenAI API server. The middleware incorrectly used URL(scope=scope).path to reconstruct the request's URL path for authentication checks. This method is unsafe because it relies on the Host header from the incoming request, which is not properly sanitized by the underlying ASGI server (uvicorn). An attacker could send a request with a crafted Host header (e.g., Host: localhost/v1/models?) to manipulate the reconstructed path. This would cause the authentication check, which verifies if the path starts with /v1, to fail, allowing the request to bypass the API key verification and access protected endpoints. The patch fixes this by using scope["path"] directly, which provides the correct, unalterable request path. The vulnerable function is AuthenticationMiddleware.__call__, as this is where the flawed URL path reconstruction and authentication check occur.

Vulnerable functions

AuthenticationMiddleware.__call__

vllm/entrypoints/openai/server_utils.py

The `__call__` method of the `AuthenticationMiddleware` class was vulnerable because it constructed the URL path from the request's scope, which includes the `Host` header. An attacker could inject special characters into the `Host` header to manipulate the `url_path` and bypass the authentication check. The vulnerability is in the line that uses `URL(scope=scope).path` to determine the path for the authentication check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.