CVE-2026-115917

The vLLM inference and serving engine for large language models is vulnerable to cross-origin requests due to permissive default settings. Prior to version 0.32.0 , the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. This allows a ma...