2026-06-22 · 2026-Q2
vLLM OpenAI-Compatible API Authentication Bypass (CVE-2026-48746)
Primary layerL6 Identity / Run
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
vLLM OpenAI-compatible API server, versions 0.3.0 through 0.21.x (fixed in 0.22.0)
Impact
A remote attacker bypasses API-key authentication and reaches protected inference endpoints without a valid `VLLM_API_KEY` or `--api-key`
Root cause
`AuthenticationMiddleware.__call__` reconstructed the request path with `URL(scope=scope).path`, which trusts the unsanitized `Host` header; a crafted `Host: localhost/v1/models?` manipulates the path so the `/v1` auth check fails open. The fix uses `scope["path"]` directly
CVE
Sources
Catalog
Cite this: AgentProv incident record: vLLM OpenAI-Compatible API Authentication Bypass (CVE-2026-48746) (2026-06-22). https://agentprov.com/incidents/2026-06-22-vllm-openai-compatible-api-authentication-bypass-cve-2026-48746
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run