vLLM’s OpenAI‑compatible server originally configured Starlette CORS middleware with a wildcard origin policy. This permissive setting allowed any browser to send requests from arbitrary web pages to the vLLM HTTP endpoints. An attacker could host a malicious webpage, trick a user into visiting it, and then use the victim’s browser to call unauthenticated endpoints such as GET /v1/models and POST /v1/chat/completions. The responses could be read to gain insight into available models and to consume GPU resources. Because credentials are disabled by default, cookie‑based cross‑site request forgery mechanisms do not apply, but the open CORS policy itself is a weakness resembling CWE‑942. The impact is primarily data exposure and unauthorized use of compute resources, though no direct remote code execution or privilege escalation is possible.

Deployments of the vLLM inference engine from vllm‑project with versions prior to 0.32.0 are vulnerable. The issue is fixed in v0.32.0 and subsequent releases where the allowed_origins default has been tightened.

The risk profile is moderate. The CVSS score of 3.4 indicates low severity, and the EPSS score is unavailable, so exploitation likelihood is uncertain. The vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve a compromised or malicious web page accessed by a user who has local or internal network access to the vLLM server. If the server is exposed to the public internet or a VPN, the same page can send requests from any client using the browser, making the exploit practicality higher when users are expected to interact with the service from their browsers.