CVE-2026-48746

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 9.1EPSS 1%

Published 2026-06-22Updated 2026-06-22

Vulnerability details

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CNAGitHub_M

EPSS score history

Sources

5 links

PoC links are not available for guest users. Login to view them.

GitHub Security Advisories The Hacker News CVE Organization NVD Analysis RedHat Vuln DB

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated