Cross-Origin Resource Sharing Misconfiguration in vLLM

Executive Summary

vLLM versions before 0.32.0 configured Starlette CORSMiddleware with allowed_origins set to a wildcard by default. This allowed any web page to send requests to a vLLM server accessible via a victim's browser, such as localhost or internal networks, and read responses. The vulnerability enables malicious pages to enumerate models, issue chat completions, consume GPU resources, and read outputs without authentication unless an API key is configured.

Useful 0 Not Useful 0

Detection Guidance

Check if your vLLM server is running a version prior to 0.32.0 by running: vllm --version. Inspect CORS settings in configuration files or CLI arguments for --allowed-origins set to wildcard or empty. Test network access by attempting cross-origin requests from a browser to endpoints like GET /v1/models or POST /v1/chat/completions.

Useful 0 Not Useful 0

Impact Analysis

If you run a vulnerable vLLM server, an attacker could trick you into visiting a malicious webpage that uses your browser to access the server. They could then read model outputs, consume GPU resources, or interact with the server without your knowledge. This is especially risky if the server is exposed on localhost, internal networks, or VPNs.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.32.0 or later. If upgrading is not possible, explicitly set --allowed-origins to trusted domains instead of using wildcard. Disable unauthenticated access if not required. Monitor network traffic for unauthorized cross-origin requests to vLLM endpoints.

Useful 0 Not Useful 0