A flaw in vLLM’s integration with ASGI web servers and Starlette’s trust mechanism allows an attacker to call the OpenAI API endpoints without supplying the configured VLLM_API_KEY or --api-key. By exploiting this weakness, a client can obtain unrestricted access to the LLM inference service, potentially leading to unauthorized model usage, data leaks, and service abuse.

Versions of the vLLM inference engine from 0.3.0 through 0.22.0, inclusive, are affected. These releases are available from the vllm‑project under the product name vLLM.

The vulnerability scores a high CVSS of 9.1 and is not listed in the CISA KEV catalog. No EPSS score is available, but the high severity indicates significant potential impact. The likely attack vector is network‑based: a client can issue HTTP requests to the exposed API endpoints on an ASGI compatible server that trusts certain headers, thereby bypassing the authentication middleware.