GHSA-vvpg-rrww-wpmh vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

• PyPI vllm: < 0.32.0 → fixed in 0.32.0

Summary The OpenAI-compatible server registers Starlette `CORSMiddleware` with `allowed_origins` defaulting to `["*"]`, and performs no authentication unless `--api-key` (or `VLLM_API_KEY`) is configured. A web page on any origin can send requests to a vLLM server that the victim's browser can reach (for example `localhost` or an internal/VPN address) and read the responses. The default `allow_credentials=False` blocks cookie-bearing cross-origin requests; because vLLM authenticates with a bearer header rather than cookies, the wildcard still permits untokenized access to an unauthenticated server and read access when the caller already holds a token. Details Affected components • `vllm/entrypoints/launchers/cli_args.py` - `allowed_origins` default value. • `vllm/entrypoints/serve/middleware/register.py` - `CORSMiddleware` registration. • `vllm/entrypoints/serve/middleware/authenticate.py` - auth middleware and its guarded path prefixes. Root cause `vllm/entrypoints/launchers/cli_args.py`: ```python allow_credentials: bool = False """Allow credentials.""" allowed_origins: list[str] = field(default_factory=lambda: ["*"]) """Allowed origins.""" ``` `vllm/entrypoints/serve/middleware/register.py`: ```python app.add_middleware( CORSMiddleware, allow_origins=args.allowed_origins, allow_credentials=args.allow_credentials, allow_methods=args.allowed_methods, allow_headers=args.allowed_headers, ) ``` The auth middleware is added only when a token is configured and guards only the `/v1`, `/v2`, `/inference`, and `/cohere` prefixes. `/v1/load_lora_adapter` and `/v1/unload_lora_adapter` are inside `/v1` and therefore do require a key when one is set; they are open only when no key is configured and dynamic LoRA updating is enabled. Impact • A malicious page can enumerate models (`GET /v1/models`), issue `POST /v1/chat/completions`, consume GPU time, and read model output through the victim's browser. • When the server is reachable only from the victim's network, the browser acts as a proxy a remote website could not otherwise use. • With `allow_credentials=False`, cookie-based CSRF does not apply; the exposure is cross-origin request execution and response disclosure. This advisory was fixed in MR61009.